CVE-2023-53021
published 2025-03-27CVE-2023-53021: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_taprio: fix possible use-after-free syzbot reported a nasty crash [1] in…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.18%
8.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_taprio: fix possible use-after-free
syzbot reported a nasty crash [1] in net_tx_action() which
made little sense until we got a repro.
This repro installs a taprio qdisc, but providing an
invalid TCA_RATE attribute.
qdisc_create() has to destroy the just initialized
taprio qdisc, and taprio_destroy() is called.
However, the hrtimer used by taprio had already fired,
therefore advance_sched() called __netif_schedule().
Then net_tx_action was trying to use a destroyed qdisc.
We can not undo the __netif_schedule(), so we must wait
until one cpu serviced the qdisc before we can proceed.
Many thanks to Alexander Potapenko for his help.
[1]
BUG: KMSAN: uninit-value in queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline]
BUG: KMSAN: uninit-value in do_raw_spin_trylock include/linux/spinlock.h:191 [inline]
BUG: KMSAN: uninit-value in __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline]
BUG: KMSAN: uninit-value in _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138
queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline]
do_raw_spin_trylock include/linux/spinlock.h:191 [inline]
__raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline]
_raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138
spin_trylock include/linux/spinlock.h:359 [inline]
qdisc_run_begin include/net/sch_generic.h:187 [inline]
qdisc_run+0xee/0x540 include/net/pkt_sched.h:125
net_tx_action+0x77c/0x9a0 net/core/dev.c:5086
__do_softirq+0x1cc/0x7fb kernel/softirq.c:571
run_ksoftirqd+0x2c/0x50 kernel/softirq.c:934
smpboot_thread_fn+0x554/0x9f0 kernel/smpboot.c:164
kthread+0x31b/0x430 kernel/kthread.c:376
ret_from_fork+0x1f/0x30
Uninit was created at:
slab_post_alloc_hook mm/slab.h:732 [inline]
slab_alloc_node mm/slub.c:3258 [inline]
__kmalloc_node_track_caller+0x814/0x1250 mm/slub.c:4970
kmalloc_reserve net/core/skbuff.c:358 [inline]
__alloc_skb+0x346/0xcf0 net/core/skbuff.c:430
a
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.11-1 (bookworm) | linux 6.1.11-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 < 1200388a0b1c3c6fda48d4d2143db8f7e4ef5348 | 1200388a0b1c3c6fda48d4d2143db8f7e4ef5348 |
| linux | linux | >= 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 < c60fe70078d6e515f424cb868d07e00411b27fbc | c60fe70078d6e515f424cb868d07e00411b27fbc |
| linux | linux | >= 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 < c53acbf2facfdfabdc6e6984a1a38f5d38b606a1 | c53acbf2facfdfabdc6e6984a1a38f5d38b606a1 |
| linux | linux | >= 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 < d3b2d2820a005e43855fa71b80c4a4b194201c60 | d3b2d2820a005e43855fa71b80c4a4b194201c60 |
| linux | linux | >= 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 < 3a415d59c1dbec9d772dbfab2d2520d98360caae | 3a415d59c1dbec9d772dbfab2d2520d98360caae |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 4.20 < 5.4.231 | 5.4.231 |
| linux | linux_kernel | >= 5.11 < 5.15.91 | 5.15.91 |
| linux | linux_kernel | >= 5.16 < 6.1.9 | 6.1.9 |
| linux | linux_kernel | >= 5.5 < 5.10.166 | 5.10.166 |
| moodle | moodle | >= 3.0.0 < 4.0.0 | 4.0.0 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: net/sched: sch_taprio: fix possible use-after-free
vendor_redhat·2025-03-27·CVSS 7.8
CVE-2023-53021 [HIGH] kernel: net/sched: sch_taprio: fix possible use-after-free
kernel: net/sched: sch_taprio: fix possible use-after-free
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_taprio: fix possible use-after-free
syzbot reported a nasty crash [1] in net_tx_action() which
made little sense until we got a repro.
This repro installs a taprio qdisc, but providing an
invalid TCA_RATE attribute.
qdisc_create() has to destroy the just initialized
taprio qdisc, and taprio_destroy() is called.
However, the hrtimer used by taprio had already fired,
therefore advance_sched() called __netif_schedule().
Then net_tx_action was trying to use a destroyed qdisc.
We can not undo the __netif_schedule(), so we must wait
until one cpu serviced the qdisc before we can proceed.
Many thanks to Alexander Potapenko for his help.
[1]
BUG: KMSAN: uni
Debian
CVE-2023-53021: linux - In the Linux kernel, the following vulnerability has been resolved: net/sched: ...
vendor_debian·2023·CVSS 7.8
CVE-2023-53021 [HIGH] CVE-2023-53021: linux - In the Linux kernel, the following vulnerability has been resolved: net/sched: ...
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_taprio: fix possible use-after-free syzbot reported a nasty crash [1] in net_tx_action() which made little sense until we got a repro. This repro installs a taprio qdisc, but providing an invalid TCA_RATE attribute. qdisc_create() has to destroy the just initialized taprio qdisc, and taprio_destroy() is called. However, the hrtimer used by taprio had already fired, therefore advance_sched() called __netif_schedule(). Then net_tx_action was trying to use a destroyed qdisc. We can not undo the __netif_schedule(), so we must wait until one cpu serviced the qdisc before we can proceed. Many thanks to Alexander Potapenko for his help. [1] BUG: KMSAN: uninit-value in queued_spin_trylock include/asm-generic/qspinlo
GHSA
Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter
ghsa·2025-06-24
CVE-2025-53021 [MEDIUM] CWE-384 Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter
Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
OSV
CVE-2023-53021: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_taprio: fix possible use-after-free syzbot reported a nasty crash [
osv·2025-03-27·CVSS 7.8
CVE-2023-53021 [HIGH] CVE-2023-53021: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_taprio: fix possible use-after-free syzbot reported a nasty crash [
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_taprio: fix possible use-after-free syzbot reported a nasty crash [1] in net_tx_action() which made little sense until we got a repro. This repro installs a taprio qdisc, but providing an invalid TCA_RATE attribute. qdisc_create() has to destroy the just initialized taprio qdisc, and taprio_destroy() is called. However, the hrtimer used by taprio had already fired, therefore advance_sched() called __netif_schedule(). Then net_tx_action was trying to use a destroyed qdisc. We can not undo the __netif_schedule(), so we must wait until one cpu serviced the qdisc before we can proceed. Many thanks to Alexander Potapenko for his help. [1] BUG: KMSAN: uninit-value in queued_spin_trylock include/asm-generic/qspinlo
GHSA
GHSA-j94v-m9xh-gwvq: In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_taprio: fix possible use-after-free
syzbot reported a nasty crash
ghsa_unreviewed·2025-03-27
CVE-2023-53021 [HIGH] CWE-416 GHSA-j94v-m9xh-gwvq: In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_taprio: fix possible use-after-free
syzbot reported a nasty crash
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_taprio: fix possible use-after-free
syzbot reported a nasty crash [1] in net_tx_action() which
made little sense until we got a repro.
This repro installs a taprio qdisc, but providing an
invalid TCA_RATE attribute.
qdisc_create() has to destroy the just initialized
taprio qdisc, and taprio_destroy() is called.
However, the hrtimer used by taprio had already fired,
therefore advance_sched() called __netif_schedule().
Then net_tx_action was trying to use a destroyed qdisc.
We can not undo the __netif_schedule(), so we must wait
until one cpu serviced the qdisc before we can proceed.
Many thanks to Alexander Potapenko for his help.
[1]
BUG: KMSAN: uninit-value in queued_spin_trylock include/asm-generi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/1200388a0b1c3c6fda48d4d2143db8f7e4ef5348https://git.kernel.org/stable/c/3a415d59c1dbec9d772dbfab2d2520d98360caaehttps://git.kernel.org/stable/c/c53acbf2facfdfabdc6e6984a1a38f5d38b606a1https://git.kernel.org/stable/c/c60fe70078d6e515f424cb868d07e00411b27fbchttps://git.kernel.org/stable/c/d3b2d2820a005e43855fa71b80c4a4b194201c60
2025-03-27
Published