CVE-2023-53023
published 2025-03-27CVE-2023-53023: In the Linux kernel, the following vulnerability has been resolved: net: nfc: Fix use-after-free in local_cleanup() Fix a use-after-free that occurs in…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.18%
8.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: nfc: Fix use-after-free in local_cleanup()
Fix a use-after-free that occurs in kfree_skb() called from
local_cleanup(). This could happen when killing nfc daemon (e.g. neard)
after detaching an nfc device.
When detaching an nfc device, local_cleanup() called from
nfc_llcp_unregister_device() frees local->rx_pending and decreases
local->ref by kref_put() in nfc_llcp_local_put().
In the terminating process, nfc daemon releases all sockets and it leads
to decreasing local->ref. After the last release of local->ref,
local_cleanup() called from local_release() frees local->rx_pending
again, which leads to the bug.
Setting local->rx_pending to NULL in local_cleanup() could prevent
use-after-free when local_cleanup() is called twice.
Found by a modified version of syzkaller.
BUG: KASAN: use-after-free in kfree_skb()
Call Trace:
dump_stack_lvl (lib/dump_stack.c:106)
print_address_description.constprop.0.cold (mm/kasan/report.c:306)
kasan_check_range (mm/kasan/generic.c:189)
kfree_skb (net/core/skbuff.c:955)
local_cleanup (net/nfc/llcp_core.c:159)
nfc_llcp_local_put.part.0 (net/nfc/llcp_core.c:172)
nfc_llcp_local_put (net/nfc/llcp_core.c:181)
llcp_sock_destruct (net/nfc/llcp_sock.c:959)
__sk_destruct (net/core/sock.c:2133)
sk_destruct (net/core/sock.c:2181)
__sk_free (net/core/sock.c:2192)
sk_free (net/core/sock.c:2203)
llcp_sock_release (net/nfc/llcp_sock.c:646)
__sock_release (net/socket.c:650)
sock_close (net/socket.c:1365)
__fput (fs/file_table.c:306)
task_work_run (kernel/task_work.c:179)
ptrace_notify (kernel/signal.c:2354)
syscall_exit_to_user_mode_prepare (kernel/entry/common.c:278)
syscall_exit_to_user_mode (kernel/entry/common.c:296)
do_syscall_64 (arch/x86/entry/common.c:86)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:106)
Allocated by task 4719:
kasan_save_stack (mm/kasan/common.c:45)
__kasan_slab_alloc (mm/kasan/common.c:325)
slab_post_alloc_hook (mm/slab.h:766)
kmem_ca
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.11-1 (bookworm) | linux 6.1.11-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 3536da06db0baa675f32de608c0a4c0f5ef0e9ff < b09ae26f08aaf2d85f96ea7f90ddd3387f62216f | b09ae26f08aaf2d85f96ea7f90ddd3387f62216f |
| linux | linux | >= 3536da06db0baa675f32de608c0a4c0f5ef0e9ff < 54f7be61584b8ec4c6df405f479495b9397bae4a | 54f7be61584b8ec4c6df405f479495b9397bae4a |
| linux | linux | >= 3536da06db0baa675f32de608c0a4c0f5ef0e9ff < a59cdbda3714e11aa3ab579132864c4c8c6d54f9 | a59cdbda3714e11aa3ab579132864c4c8c6d54f9 |
| linux | linux | >= 3536da06db0baa675f32de608c0a4c0f5ef0e9ff < ad1baab3a5c03692d22ce446f38596a126377f6a | ad1baab3a5c03692d22ce446f38596a126377f6a |
| linux | linux | >= 3536da06db0baa675f32de608c0a4c0f5ef0e9ff < 7f129927feaf7c10b1c38bbce630172e9a08c834 | 7f129927feaf7c10b1c38bbce630172e9a08c834 |
| linux | linux | >= 3536da06db0baa675f32de608c0a4c0f5ef0e9ff < d3605282ec3502ec8847915eb2cf1f340493ff79 | d3605282ec3502ec8847915eb2cf1f340493ff79 |
| linux | linux | >= 3536da06db0baa675f32de608c0a4c0f5ef0e9ff < 4bb4db7f3187c6e3de6b229ffc87cdb30a2d22b6 | 4bb4db7f3187c6e3de6b229ffc87cdb30a2d22b6 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 0 < 6.3.7-1 | 6.3.7-1 |
| linux | linux_kernel | >= 3.9 < 4.14.305 | 4.14.305 |
| linux | linux_kernel | >= 4.15 < 4.19.272 | 4.19.272 |
| linux | linux_kernel | >= 4.20 < 5.4.231 | 5.4.231 |
| linux | linux_kernel | >= 5.11 < 5.15.91 | 5.15.91 |
| linux | linux_kernel | >= 5.16 < 6.1.9 | 6.1.9 |
| linux | linux_kernel | >= 5.5 < 5.10.166 | 5.10.166 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-53023: In the Linux kernel, the following vulnerability has been resolved: net: nfc: Fix use-after-free in local_cleanup() Fix a use-after-free that occurs i
osv·2025-03-27·CVSS 7.8
CVE-2023-53023 [HIGH] CVE-2023-53023: In the Linux kernel, the following vulnerability has been resolved: net: nfc: Fix use-after-free in local_cleanup() Fix a use-after-free that occurs i
In the Linux kernel, the following vulnerability has been resolved: net: nfc: Fix use-after-free in local_cleanup() Fix a use-after-free that occurs in kfree_skb() called from local_cleanup(). This could happen when killing nfc daemon (e.g. neard) after detaching an nfc device. When detaching an nfc device, local_cleanup() called from nfc_llcp_unregister_device() frees local->rx_pending and decreases local->ref by kref_put() in nfc_llcp_local_put(). In the terminating process, nfc daemon releases all sockets and it leads to decreasing local->ref. After the last release of local->ref, local_cleanup() called from local_release() frees local->rx_pending again, which leads to the bug. Setting local->rx_pending to NULL in local_cleanup() could prevent use-after-free when local_cleanup() is call
GHSA
GHSA-p7rv-2f34-8mwf: In the Linux kernel, the following vulnerability has been resolved:
net: nfc: Fix use-after-free in local_cleanup()
Fix a use-after-free that occurs
ghsa_unreviewed·2025-03-27
CVE-2023-53023 [HIGH] CWE-416 GHSA-p7rv-2f34-8mwf: In the Linux kernel, the following vulnerability has been resolved:
net: nfc: Fix use-after-free in local_cleanup()
Fix a use-after-free that occurs
In the Linux kernel, the following vulnerability has been resolved:
net: nfc: Fix use-after-free in local_cleanup()
Fix a use-after-free that occurs in kfree_skb() called from
local_cleanup(). This could happen when killing nfc daemon (e.g. neard)
after detaching an nfc device.
When detaching an nfc device, local_cleanup() called from
nfc_llcp_unregister_device() frees local->rx_pending and decreases
local->ref by kref_put() in nfc_llcp_local_put().
In the terminating process, nfc daemon releases all sockets and it leads
to decreasing local->ref. After the last release of local->ref,
local_cleanup() called from local_release() frees local->rx_pending
again, which leads to the bug.
Setting local->rx_pending to NULL in local_cleanup() could prevent
use-after-free when local_cleanup() is c
Red Hat
kernel: net: nfc: Fix use-after-free in local_cleanup()
vendor_redhat·2025-03-27·CVSS 7.8
CVE-2023-53023 [HIGH] CWE-416 kernel: net: nfc: Fix use-after-free in local_cleanup()
kernel: net: nfc: Fix use-after-free in local_cleanup()
In the Linux kernel, the following vulnerability has been resolved:
net: nfc: Fix use-after-free in local_cleanup()
Fix a use-after-free that occurs in kfree_skb() called from
local_cleanup(). This could happen when killing nfc daemon (e.g. neard)
after detaching an nfc device.
When detaching an nfc device, local_cleanup() called from
nfc_llcp_unregister_device() frees local->rx_pending and decreases
local->ref by kref_put() in nfc_llcp_local_put().
In the terminating process, nfc daemon releases all sockets and it leads
to decreasing local->ref. After the last release of local->ref,
local_cleanup() called from local_release() frees local->rx_pending
again, which leads to the bug.
Setting local->rx_pending to NULL in local_cleanup()
Debian
CVE-2023-53023: linux - In the Linux kernel, the following vulnerability has been resolved: net: nfc: F...
vendor_debian·2023·CVSS 7.8
CVE-2023-53023 [HIGH] CVE-2023-53023: linux - In the Linux kernel, the following vulnerability has been resolved: net: nfc: F...
In the Linux kernel, the following vulnerability has been resolved: net: nfc: Fix use-after-free in local_cleanup() Fix a use-after-free that occurs in kfree_skb() called from local_cleanup(). This could happen when killing nfc daemon (e.g. neard) after detaching an nfc device. When detaching an nfc device, local_cleanup() called from nfc_llcp_unregister_device() frees local->rx_pending and decreases local->ref by kref_put() in nfc_llcp_local_put(). In the terminating process, nfc daemon releases all sockets and it leads to decreasing local->ref. After the last release of local->ref, local_cleanup() called from local_release() frees local->rx_pending again, which leads to the bug. Setting local->rx_pending to NULL in local_cleanup() could prevent use-after-free when local_cleanup() is call
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/4bb4db7f3187c6e3de6b229ffc87cdb30a2d22b6https://git.kernel.org/stable/c/54f7be61584b8ec4c6df405f479495b9397bae4ahttps://git.kernel.org/stable/c/7f129927feaf7c10b1c38bbce630172e9a08c834https://git.kernel.org/stable/c/a59cdbda3714e11aa3ab579132864c4c8c6d54f9https://git.kernel.org/stable/c/ad1baab3a5c03692d22ce446f38596a126377f6ahttps://git.kernel.org/stable/c/b09ae26f08aaf2d85f96ea7f90ddd3387f62216fhttps://git.kernel.org/stable/c/d3605282ec3502ec8847915eb2cf1f340493ff79
2025-03-27
Published