CVE-2023-52895
published 2024-08-21CVE-2023-52895: In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: don't reissue in case of poll race on multishot request A previous commit…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.21%
10.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
io_uring/poll: don't reissue in case of poll race on multishot request
A previous commit fixed a poll race that can occur, but it's only
applicable for multishot requests. For a multishot request, we can safely
ignore a spurious wakeup, as we never leave the waitqueue to begin with.
A blunt reissue of a multishot armed request can cause us to leak a
buffer, if they are ring provided. While this seems like a bug in itself,
it's not really defined behavior to reissue a multishot request directly.
It's less efficient to do so as well, and not required to rearm anything
like it is for singleshot poll requests.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.8-1 (bookworm) | linux 6.1.8-1 (bookworm) |
| linux | linux | >= 6.1.7 < 6.1.8 | 6.1.8 |
| linux | linux | >= 6e5aedb9324aab1c14a23fae3d8eeb64a679c20e < 8caa03f10bf92cb8657408a6ece6a8a73f96ce13 | 8caa03f10bf92cb8657408a6ece6a8a73f96ce13 |
| linux | linux | >= c06015ebc4367be38904b88582e13cc079672075 < 36fc7317cdb16cfeae0f879916995037bb615ac4 | 36fc7317cdb16cfeae0f879916995037bb615ac4 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.1.8-1 | 6.1.8-1 |
| linux | linux_kernel | >= 0 < 6.1.8-1 | 6.1.8-1 |
| linux | linux_kernel | >= 0 < 6.1.8-1 | 6.1.8-1 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: io_uring/poll: don't reissue in case of poll race on multishot request
vendor_redhat·2024-08-21·CVSS 5.5
CVE-2023-52895 [MEDIUM] CWE-401 kernel: io_uring/poll: don't reissue in case of poll race on multishot request
kernel: io_uring/poll: don't reissue in case of poll race on multishot request
In the Linux kernel, the following vulnerability has been resolved:
io_uring/poll: don't reissue in case of poll race on multishot request
A previous commit fixed a poll race that can occur, but it's only
applicable for multishot requests. For a multishot request, we can safely
ignore a spurious wakeup, as we never leave the waitqueue to begin with.
A blunt reissue of a multishot armed request can cause us to leak a
buffer, if they are ring provided. While this seems like a bug in itself,
it's not really defined behavior to reissue a multishot request directly.
It's less efficient to do so as well, and not required to rearm anything
like it is for singleshot poll requests.
Package: kernel (Red Hat Enterprise L
Debian
CVE-2023-52895: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/po...
vendor_debian·2023·CVSS 5.5
CVE-2023-52895 [MEDIUM] CVE-2023-52895: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring/po...
In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: don't reissue in case of poll race on multishot request A previous commit fixed a poll race that can occur, but it's only applicable for multishot requests. For a multishot request, we can safely ignore a spurious wakeup, as we never leave the waitqueue to begin with. A blunt reissue of a multishot armed request can cause us to leak a buffer, if they are ring provided. While this seems like a bug in itself, it's not really defined behavior to reissue a multishot request directly. It's less efficient to do so as well, and not required to rearm anything like it is for singleshot poll requests.
Scope: local
bookworm: resolved (fixed in 6.1.8-1)
bullseye: resolved
forky: resolved (fixed in 6.1.8-1)
sid: resolved
GHSA
GHSA-7rjr-qxc3-7hh3: In the Linux kernel, the following vulnerability has been resolved:
io_uring/poll: don't reissue in case of poll race on multishot request
A previou
ghsa_unreviewed·2024-08-21
CVE-2023-52895 [MEDIUM] CWE-401 GHSA-7rjr-qxc3-7hh3: In the Linux kernel, the following vulnerability has been resolved:
io_uring/poll: don't reissue in case of poll race on multishot request
A previou
In the Linux kernel, the following vulnerability has been resolved:
io_uring/poll: don't reissue in case of poll race on multishot request
A previous commit fixed a poll race that can occur, but it's only
applicable for multishot requests. For a multishot request, we can safely
ignore a spurious wakeup, as we never leave the waitqueue to begin with.
A blunt reissue of a multishot armed request can cause us to leak a
buffer, if they are ring provided. While this seems like a bug in itself,
it's not really defined behavior to reissue a multishot request directly.
It's less efficient to do so as well, and not required to rearm anything
like it is for singleshot poll requests.
OSV
CVE-2023-52895: In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: don't reissue in case of poll race on multishot request A previous
osv·2024-08-21·CVSS 5.5
CVE-2023-52895 [MEDIUM] CVE-2023-52895: In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: don't reissue in case of poll race on multishot request A previous
In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: don't reissue in case of poll race on multishot request A previous commit fixed a poll race that can occur, but it's only applicable for multishot requests. For a multishot request, we can safely ignore a spurious wakeup, as we never leave the waitqueue to begin with. A blunt reissue of a multishot armed request can cause us to leak a buffer, if they are ring provided. While this seems like a bug in itself, it's not really defined behavior to reissue a multishot request directly. It's less efficient to do so as well, and not required to rearm anything like it is for singleshot poll requests.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-08-21
Published