CVE-2023-52636
published 2024-04-02CVE-2023-52636: In the Linux kernel, the following vulnerability has been resolved: libceph: just wait for more data to be available on the socket A short read may occur while…
PriorityP424medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.51%
40.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
libceph: just wait for more data to be available on the socket
A short read may occur while reading the message footer from the
socket. Later, when the socket is ready for another read, the
messenger invokes all read_partial_*() handlers, including
read_partial_sparse_msg_data(). The expectation is that
read_partial_sparse_msg_data() would bail, allowing the messenger to
invoke read_partial() for the footer and pick up where it left off.
However read_partial_sparse_msg_data() violates that and ends up
calling into the state machine in the OSD client. The sparse-read
state machine assumes that it's a new op and interprets some piece of
the footer as the sparse-read header and returns bogus extents/data
length, etc.
To determine whether read_partial_sparse_msg_data() should bail, let's
reuse cursor->total_resid. Because once it reaches to zero that means
all the extents and data have been successfully received in last read,
else it could break out when partially reading any of the extents and
data. And then osd_sparse_read() could continue where it left off.
[ idryomov: changelog ]
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.7.7-1 (forky) | linux 6.7.7-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= d396f89db39a2f259e2125ca43b4c31bb65afcad < da9c33a70f095d5d55c36d0bfeba969e31de08ae | da9c33a70f095d5d55c36d0bfeba969e31de08ae |
| linux | linux | >= d396f89db39a2f259e2125ca43b4c31bb65afcad < bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8 | bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8 |
| linux | linux | >= d396f89db39a2f259e2125ca43b4c31bb65afcad < 8e46a2d068c92a905d01cbb018b00d66991585ab | 8e46a2d068c92a905d01cbb018b00d66991585ab |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.7.7-1 | 6.7.7-1 |
| linux | linux_kernel | >= 0 < 6.7.7-1 | 6.7.7-1 |
| linux | linux_kernel | >= 6.6 < 6.6.17 | 6.6.17 |
| linux | linux_kernel | >= 6.7 < 6.7.5 | 6.7.5 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.6.16/6.7.4 libceph read_partial_sparse_msg_data state issue (da9c33a70f09/bd9442e553ab/8e46a2d068c9)
vuldb·2026-08-05·CVSS 5.5
CVE-2023-52636 [MEDIUM] Linux Kernel up to 6.6.16/6.7.4 libceph read_partial_sparse_msg_data state issue (da9c33a70f09/bd9442e553ab/8e46a2d068c9)
A vulnerability was found in Linux Kernel up to 6.6.16/6.7.4 and classified as problematic. The affected element is the function read_partial_sparse_msg_data of the component libceph. The manipulation results in state issue.
This vulnerability is known as CVE-2023-52636. Access to the local network is required for this attack. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
GHSA-fqg2-664v-fx4j: In the Linux kernel, the following vulnerability has been resolved:
libceph: just wait for more data to be available on the socket
A short read may
ghsa_unreviewed·2024-04-02
CVE-2023-52636 [MEDIUM] GHSA-fqg2-664v-fx4j: In the Linux kernel, the following vulnerability has been resolved:
libceph: just wait for more data to be available on the socket
A short read may
In the Linux kernel, the following vulnerability has been resolved:
libceph: just wait for more data to be available on the socket
A short read may occur while reading the message footer from the
socket. Later, when the socket is ready for another read, the
messenger invokes all read_partial_*() handlers, including
read_partial_sparse_msg_data(). The expectation is that
read_partial_sparse_msg_data() would bail, allowing the messenger to
invoke read_partial() for the footer and pick up where it left off.
However read_partial_sparse_msg_data() violates that and ends up
calling into the state machine in the OSD client. The sparse-read
state machine assumes that it's a new op and interprets some piece of
the footer as the sparse-read header and returns bogus extents/data
length, etc.
To d
OSV
CVE-2023-52636: In the Linux kernel, the following vulnerability has been resolved: libceph: just wait for more data to be available on the socket A short read may oc
osv·2024-04-02·CVSS 5.5
CVE-2023-52636 [MEDIUM] CVE-2023-52636: In the Linux kernel, the following vulnerability has been resolved: libceph: just wait for more data to be available on the socket A short read may oc
In the Linux kernel, the following vulnerability has been resolved: libceph: just wait for more data to be available on the socket A short read may occur while reading the message footer from the socket. Later, when the socket is ready for another read, the messenger invokes all read_partial_*() handlers, including read_partial_sparse_msg_data(). The expectation is that read_partial_sparse_msg_data() would bail, allowing the messenger to invoke read_partial() for the footer and pick up where it left off. However read_partial_sparse_msg_data() violates that and ends up calling into the state machine in the OSD client. The sparse-read state machine assumes that it's a new op and interprets some piece of the footer as the sparse-read header and returns bogus extents/data length, etc. To deter
Red Hat
kernel: libceph: just wait for more data to be available on the socket
vendor_redhat·2024-04-02·CVSS 5.5
CVE-2023-52636 [MEDIUM] CWE-20 kernel: libceph: just wait for more data to be available on the socket
kernel: libceph: just wait for more data to be available on the socket
In the Linux kernel, the following vulnerability has been resolved:
libceph: just wait for more data to be available on the socket
A short read may occur while reading the message footer from the
socket. Later, when the socket is ready for another read, the
messenger invokes all read_partial_*() handlers, including
read_partial_sparse_msg_data(). The expectation is that
read_partial_sparse_msg_data() would bail, allowing the messenger to
invoke read_partial() for the footer and pick up where it left off.
However read_partial_sparse_msg_data() violates that and ends up
calling into the state machine in the OSD client. The sparse-read
state machine assumes that it's a new op and interprets some piece of
the footer as the
Debian
CVE-2023-52636: linux - In the Linux kernel, the following vulnerability has been resolved: libceph: ju...
vendor_debian·2023·CVSS 5.5
CVE-2023-52636 [MEDIUM] CVE-2023-52636: linux - In the Linux kernel, the following vulnerability has been resolved: libceph: ju...
In the Linux kernel, the following vulnerability has been resolved: libceph: just wait for more data to be available on the socket A short read may occur while reading the message footer from the socket. Later, when the socket is ready for another read, the messenger invokes all read_partial_*() handlers, including read_partial_sparse_msg_data(). The expectation is that read_partial_sparse_msg_data() would bail, allowing the messenger to invoke read_partial() for the footer and pick up where it left off. However read_partial_sparse_msg_data() violates that and ends up calling into the state machine in the OSD client. The sparse-read state machine assumes that it's a new op and interprets some piece of the footer as the sparse-read header and returns bogus extents/data length, etc. To deter
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585abhttps://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08aehttps://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585abhttps://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae
2024-04-02
Published