CVE-2023-52885
published 2024-07-14CVE-2023-52885: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() After the listener svc_sock is freed, and…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.21%
12.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
After the listener svc_sock is freed, and before invoking svc_tcp_accept()
for the established child sock, there is a window that the newsock
retaining a freed listener svc_sock in sk_user_data which cloning from
parent. In the race window, if data is received on the newsock, we will
observe use-after-free report in svc_tcp_listen_data_ready().
Reproduce by two tasks:
1. while :; do rpc.nfsd 0 ; rpc.nfsd; done
2. while :; do echo "" | ncat -4 127.0.0.1 2049 ; done
KASAN report:
BUG: KASAN: slab-use-after-free in svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc]
Read of size 8 at addr ffff888139d96228 by task nc/102553
CPU: 7 PID: 102553 Comm: nc Not tainted 6.3.0+ #18
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
Call Trace:
dump_stack_lvl+0x33/0x50
print_address_description.constprop.0+0x27/0x310
print_report+0x3e/0x70
kasan_report+0xae/0xe0
svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc]
tcp_data_queue+0x9f4/0x20e0
tcp_rcv_established+0x666/0x1f60
tcp_v4_do_rcv+0x51c/0x850
tcp_v4_rcv+0x23fc/0x2e80
ip_protocol_deliver_rcu+0x62/0x300
ip_local_deliver_finish+0x267/0x350
ip_local_deliver+0x18b/0x2d0
ip_rcv+0x2fb/0x370
__netif_receive_skb_one_core+0x166/0x1b0
process_backlog+0x24c/0x5e0
__napi_poll+0xa2/0x500
net_rx_action+0x854/0xc90
__do_softirq+0x1bb/0x5de
do_softirq+0xcb/0x100
...
Allocated by task 102371:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
__kasan_kmalloc+0x7b/0x90
svc_setup_socket+0x52/0x4f0 [sunrpc]
svc_addsock+0x20d/0x400 [sunrpc]
__write_ports_addfd+0x209/0x390 [nfsd]
write_ports+0x239/0x2c0 [nfsd]
nfsctl_transaction_write+0xac/0x110 [nfsd]
vfs_write+0x1c3/0xae0
ksys_write+0xed/0x1c0
do_syscall_64+0x38/0x90
entry_SYSCALL_64_after_hwframe+0x72/0xdc
Freed by task 102551:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
kasan_save_free_info+0x2a/0x50
__kasan_sl
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.52-1 (bookworm) | linux 6.1.52-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= fa9251afc33c81606d70cfe91800a779096442ec < c7b8c2d06e437639694abe76978e915cfb73f428 | c7b8c2d06e437639694abe76978e915cfb73f428 |
| linux | linux | >= fa9251afc33c81606d70cfe91800a779096442ec < dfc896c4a75cb8cd7cb2dfd9b469cf1e3f004254 | dfc896c4a75cb8cd7cb2dfd9b469cf1e3f004254 |
| linux | linux | >= fa9251afc33c81606d70cfe91800a779096442ec < 42725e5c1b181b757ba11d804443922982334d9b | 42725e5c1b181b757ba11d804443922982334d9b |
| linux | linux | >= fa9251afc33c81606d70cfe91800a779096442ec < cd5ec3ee52ce4b7e283cc11facfa420c297c8065 | cd5ec3ee52ce4b7e283cc11facfa420c297c8065 |
| linux | linux | >= fa9251afc33c81606d70cfe91800a779096442ec < fbf4ace39b2e4f3833236afbb2336edbafd75eee | fbf4ace39b2e4f3833236afbb2336edbafd75eee |
| linux | linux | >= fa9251afc33c81606d70cfe91800a779096442ec < ef047411887ff0845afd642d6a687819308e1a4e | ef047411887ff0845afd642d6a687819308e1a4e |
| linux | linux | >= fa9251afc33c81606d70cfe91800a779096442ec < 7e1f989055622fd086c5dfb291fc72adf5660b6f | 7e1f989055622fd086c5dfb291fc72adf5660b6f |
| linux | linux | >= fa9251afc33c81606d70cfe91800a779096442ec < fc80fc2d4e39137869da3150ee169b40bf879287 | fc80fc2d4e39137869da3150ee169b40bf879287 |
| linux | linux_kernel | >= 0 < 5.10.191-1 | 5.10.191-1 |
| linux | linux_kernel | >= 0 < 6.1.52-1 | 6.1.52-1 |
| linux | linux_kernel | >= 0 < 6.4.4-1 | 6.4.4-1 |
| linux | linux_kernel | >= 0 < 6.4.4-1 | 6.4.4-1 |
| linux | linux_kernel | >= 0 < 4.15.0-240.252 | 4.15.0-240.252 |
| linux | linux_kernel | >= 4.15 < 4.19.291 | 4.19.291 |
| linux | linux_kernel | >= 4.20 < 5.4.251 | 5.4.251 |
| linux | linux_kernel | >= 4.8 < 4.14.322 | 4.14.322 |
| linux | linux_kernel | >= 5.11 < 5.15.121 | 5.15.121 |
| linux | linux_kernel | >= 5.16 < 6.1.39 | 6.1.39 |
| linux | linux_kernel | >= 5.5 < 5.10.188 | 5.10.188 |
| linux | linux_kernel | >= 6.2 < 6.4.4 | 6.4.4 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Kernel Live Patch Security Notice
vendor_ubuntu·2025-08-18
CVE-2022-49176 Kernel Live Patch Security Notice
Title: Kernel Live Patch Security Notice
Summary: Several security issues were fixed in the kernel.
In the Linux kernel, the following vulnerability has been
resolved: bfq: fix use-after-free in bfq_dispatch_request KASAN reports a
use-after-free report when doing normal scsi-mq test .
In the Linux kernel, the following vulnerability has been
resolved: block, bfq: don't move oom_bfqq Our test report a UAF: .
In the Linux kernel, the following vulnerability has been
resolved: Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() When
l2cap_recv_frame() is invoked to receive data, and the cid is
L2CAP_CID_A2MP, if the channel does not exist, it will create a channel.
However, after a channel is created, the hold operation of the channel is
not performed.
In the Linux kernel, the foll
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2025-08-13·CVSS 7.8
CVE-2024-38541 [HIGH] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Device tree and open firmware driver;
- SCSI subsystem;
- TTY drivers;
- Ext4 file system;
- SMB network file system;
- Bluetooth subsystem;
- Network traffic control;
- Sun RPC protocol;
- USB sound devices;
(CVE-2025-37797, CVE-2024-49950, CVE-2024-56748, CVE-2023-52975,
CVE-2024-50073, CVE-2023-52885, CVE-2023-52757, CVE-2024-38541,
CVE-2024-53239, CVE-2024-49883)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2025-08-05·CVSS 7.8
CVE-2023-52975 [HIGH] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Device tree and open firmware driver;
- SCSI subsystem;
- TTY drivers;
- Ext4 file system;
- SMB network file system;
- Bluetooth subsystem;
- Network traffic control;
- Sun RPC protocol;
- USB sound devices;
(CVE-2024-38541, CVE-2024-49883, CVE-2023-52757, CVE-2024-49950,
CVE-2024-53239, CVE-2023-52885, CVE-2024-56748, CVE-2023-52975,
CVE-2024-50073, CVE-2025-37797)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2025-08-05·CVSS 7.8
CVE-2023-52975 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Device tree and open firmware driver;
- SCSI subsystem;
- TTY drivers;
- Ext4 file system;
- SMB network file system;
- Bluetooth subsystem;
- Network traffic control;
- Sun RPC protocol;
- USB sound devices;
(CVE-2024-53239, CVE-2023-52975, CVE-2024-38541, CVE-2023-52885,
CVE-2024-49883, CVE-2025-37797, CVE-2023-52757, CVE-2024-56748,
CVE-2024-49950, CVE-2024-50073)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidab
Ubuntu
Linux kernel (FIPS) vulnerabilities
vendor_ubuntu·2025-08-05·CVSS 7.8
CVE-2024-56748 [HIGH] Linux kernel (FIPS) vulnerabilities
Title: Linux kernel (FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Device tree and open firmware driver;
- SCSI subsystem;
- TTY drivers;
- Ext4 file system;
- SMB network file system;
- Bluetooth subsystem;
- Network traffic control;
- Sun RPC protocol;
- USB sound devices;
(CVE-2023-52975, CVE-2024-56748, CVE-2023-52885, CVE-2025-37797,
CVE-2024-50073, CVE-2024-49950, CVE-2024-49883, CVE-2024-38541,
CVE-2023-52757, CVE-2024-53239)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an un
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2025-08-05·CVSS 7.8
CVE-2024-56748 [HIGH] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Device tree and open firmware driver;
- SCSI subsystem;
- TTY drivers;
- Ext4 file system;
- SMB network file system;
- Bluetooth subsystem;
- Network traffic control;
- Sun RPC protocol;
- USB sound devices;
(CVE-2023-52975, CVE-2024-38541, CVE-2024-50073, CVE-2024-53239,
CVE-2023-52757, CVE-2024-49883, CVE-2025-37797, CVE-2023-52885,
CVE-2024-49950, CVE-2024-56748)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an u
Red Hat
kernel: SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
vendor_redhat·2024-07-14·CVSS 7.8
CVE-2023-52885 [HIGH] kernel: SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
kernel: SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
After the listener svc_sock is freed, and before invoking svc_tcp_accept()
for the established child sock, there is a window that the newsock
retaining a freed listener svc_sock in sk_user_data which cloning from
parent. In the race window, if data is received on the newsock, we will
observe use-after-free report in svc_tcp_listen_data_ready().
Reproduce by two tasks:
1. while :; do rpc.nfsd 0 ; rpc.nfsd; done
2. while :; do echo "" | ncat -4 127.0.0.1 2049 ; done
KASAN report:
BUG: KASAN: slab-use-after-free in svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc]
Read of size 8 at addr ffff888139d96228 by task nc/102553
CPU: 7
Debian
CVE-2023-52885: linux - In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix...
vendor_debian·2023·CVSS 7.8
CVE-2023-52885 [HIGH] CVE-2023-52885: linux - In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix...
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() After the listener svc_sock is freed, and before invoking svc_tcp_accept() for the established child sock, there is a window that the newsock retaining a freed listener svc_sock in sk_user_data which cloning from parent. In the race window, if data is received on the newsock, we will observe use-after-free report in svc_tcp_listen_data_ready(). Reproduce by two tasks: 1. while :; do rpc.nfsd 0 ; rpc.nfsd; done 2. while :; do echo "" | ncat -4 127.0.0.1 2049 ; done KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc] Read of size 8 at addr ffff888139d96228 by task nc/10
OSV
linux-oracle vulnerabilities
osv·2025-08-13·CVSS 7.8
CVE-2025-37797 [HIGH] linux-oracle vulnerabilities
linux-oracle vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Device tree and open firmware driver;
- SCSI subsystem;
- TTY drivers;
- Ext4 file system;
- SMB network file system;
- Bluetooth subsystem;
- Network traffic control;
- Sun RPC protocol;
- USB sound devices;
(CVE-2025-37797, CVE-2024-49950, CVE-2024-56748, CVE-2023-52975,
CVE-2024-50073, CVE-2023-52885, CVE-2023-52757, CVE-2024-38541,
CVE-2024-53239, CVE-2024-49883)
OSV
linux-azure vulnerabilities
osv·2025-08-05·CVSS 7.8
CVE-2023-52975 [HIGH] linux-azure vulnerabilities
linux-azure vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Device tree and open firmware driver;
- SCSI subsystem;
- TTY drivers;
- Ext4 file system;
- SMB network file system;
- Bluetooth subsystem;
- Network traffic control;
- Sun RPC protocol;
- USB sound devices;
(CVE-2023-52975, CVE-2024-38541, CVE-2024-50073, CVE-2024-53239,
CVE-2023-52757, CVE-2024-49883, CVE-2025-37797, CVE-2023-52885,
CVE-2024-49950, CVE-2024-56748)
OSV
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm vulnerabilities
osv·2025-08-05·CVSS 7.8
[HIGH] linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm vulnerabilities
linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Device tree and open firmware driver;
- SCSI subsystem;
- TTY drivers;
- Ext4 file system;
- SMB network file system;
- Bluetooth subsystem;
- Network traffic control;
- Sun RPC protocol;
- USB sound devices;
(CVE-2024-53239, CVE-2023-52975, CVE-2024-38541, CVE-2023-52885,
CVE-2024-49883, CVE-2025-37797, CVE-2023-52757, CVE-2024-56748,
CVE-2024-49950, CVE-2024-50073)
OSV
linux-oracle vulnerabilities
osv·2025-08-05·CVSS 7.8
CVE-2024-38541 [HIGH] linux-oracle vulnerabilities
linux-oracle vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Device tree and open firmware driver;
- SCSI subsystem;
- TTY drivers;
- Ext4 file system;
- SMB network file system;
- Bluetooth subsystem;
- Network traffic control;
- Sun RPC protocol;
- USB sound devices;
(CVE-2024-38541, CVE-2024-49883, CVE-2023-52757, CVE-2024-49950,
CVE-2024-53239, CVE-2023-52885, CVE-2024-56748, CVE-2023-52975,
CVE-2024-50073, CVE-2025-37797)
OSV
linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips vulnerabilities
osv·2025-08-05·CVSS 7.8
[HIGH] linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips vulnerabilities
linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Device tree and open firmware driver;
- SCSI subsystem;
- TTY drivers;
- Ext4 file system;
- SMB network file system;
- Bluetooth subsystem;
- Network traffic control;
- Sun RPC protocol;
- USB sound devices;
(CVE-2023-52975, CVE-2024-56748, CVE-2023-52885, CVE-2025-37797,
CVE-2024-50073, CVE-2024-49950, CVE-2024-49883, CVE-2024-38541,
CVE-2023-52757, CVE-2024-53239)
OSV
CVE-2023-52885: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() After the listener svc_sock is free
osv·2024-07-14·CVSS 7.8
CVE-2023-52885 [HIGH] CVE-2023-52885: In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() After the listener svc_sock is free
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() After the listener svc_sock is freed, and before invoking svc_tcp_accept() for the established child sock, there is a window that the newsock retaining a freed listener svc_sock in sk_user_data which cloning from parent. In the race window, if data is received on the newsock, we will observe use-after-free report in svc_tcp_listen_data_ready(). Reproduce by two tasks: 1. while :; do rpc.nfsd 0 ; rpc.nfsd; done 2. while :; do echo "" | ncat -4 127.0.0.1 2049 ; done KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc] Read of size 8 at addr ffff888139d96228 by task nc/10
GHSA
GHSA-p7rj-mgww-3q4f: In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
After the listener svc_sock is fr
ghsa_unreviewed·2024-07-14
CVE-2023-52885 [HIGH] CWE-416 GHSA-p7rj-mgww-3q4f: In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
After the listener svc_sock is fr
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
After the listener svc_sock is freed, and before invoking svc_tcp_accept()
for the established child sock, there is a window that the newsock
retaining a freed listener svc_sock in sk_user_data which cloning from
parent. In the race window, if data is received on the newsock, we will
observe use-after-free report in svc_tcp_listen_data_ready().
Reproduce by two tasks:
1. while :; do rpc.nfsd 0 ; rpc.nfsd; done
2. while :; do echo "" | ncat -4 127.0.0.1 2049 ; done
KASAN report:
BUG: KASAN: slab-use-after-free in svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc]
Read of size 8 at addr ffff888139d96228 by task nc/102553
CPU: 7 PID: 102553 Comm: nc Not tainted 6.3.0+ #18
Hardw
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/42725e5c1b181b757ba11d804443922982334d9bhttps://git.kernel.org/stable/c/7e1f989055622fd086c5dfb291fc72adf5660b6fhttps://git.kernel.org/stable/c/c7b8c2d06e437639694abe76978e915cfb73f428https://git.kernel.org/stable/c/cd5ec3ee52ce4b7e283cc11facfa420c297c8065https://git.kernel.org/stable/c/dfc896c4a75cb8cd7cb2dfd9b469cf1e3f004254https://git.kernel.org/stable/c/ef047411887ff0845afd642d6a687819308e1a4ehttps://git.kernel.org/stable/c/fbf4ace39b2e4f3833236afbb2336edbafd75eeehttps://git.kernel.org/stable/c/fc80fc2d4e39137869da3150ee169b40bf879287https://git.kernel.org/stable/c/42725e5c1b181b757ba11d804443922982334d9bhttps://git.kernel.org/stable/c/7e1f989055622fd086c5dfb291fc72adf5660b6fhttps://git.kernel.org/stable/c/c7b8c2d06e437639694abe76978e915cfb73f428https://git.kernel.org/stable/c/cd5ec3ee52ce4b7e283cc11facfa420c297c8065https://git.kernel.org/stable/c/dfc896c4a75cb8cd7cb2dfd9b469cf1e3f004254https://git.kernel.org/stable/c/ef047411887ff0845afd642d6a687819308e1a4ehttps://git.kernel.org/stable/c/fbf4ace39b2e4f3833236afbb2336edbafd75eeehttps://git.kernel.org/stable/c/fc80fc2d4e39137869da3150ee169b40bf879287
2024-07-14
Published