cbcvebase.
CVE-2023-53023
published 2025-03-27

CVE-2023-53023: In the Linux kernel, the following vulnerability has been resolved: net: nfc: Fix use-after-free in local_cleanup() Fix a use-after-free that occurs in…

PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.18%
8.3th percentile
In the Linux kernel, the following vulnerability has been resolved: net: nfc: Fix use-after-free in local_cleanup() Fix a use-after-free that occurs in kfree_skb() called from local_cleanup(). This could happen when killing nfc daemon (e.g. neard) after detaching an nfc device. When detaching an nfc device, local_cleanup() called from nfc_llcp_unregister_device() frees local->rx_pending and decreases local->ref by kref_put() in nfc_llcp_local_put(). In the terminating process, nfc daemon releases all sockets and it leads to decreasing local->ref. After the last release of local->ref, local_cleanup() called from local_release() frees local->rx_pending again, which leads to the bug. Setting local->rx_pending to NULL in local_cleanup() could prevent use-after-free when local_cleanup() is called twice. Found by a modified version of syzkaller. BUG: KASAN: use-after-free in kfree_skb() Call Trace: dump_stack_lvl (lib/dump_stack.c:106) print_address_description.constprop.0.cold (mm/kasan/report.c:306) kasan_check_range (mm/kasan/generic.c:189) kfree_skb (net/core/skbuff.c:955) local_cleanup (net/nfc/llcp_core.c:159) nfc_llcp_local_put.part.0 (net/nfc/llcp_core.c:172) nfc_llcp_local_put (net/nfc/llcp_core.c:181) llcp_sock_destruct (net/nfc/llcp_sock.c:959) __sk_destruct (net/core/sock.c:2133) sk_destruct (net/core/sock.c:2181) __sk_free (net/core/sock.c:2192) sk_free (net/core/sock.c:2203) llcp_sock_release (net/nfc/llcp_sock.c:646) __sock_release (net/socket.c:650) sock_close (net/socket.c:1365) __fput (fs/file_table.c:306) task_work_run (kernel/task_work.c:179) ptrace_notify (kernel/signal.c:2354) syscall_exit_to_user_mode_prepare (kernel/entry/common.c:278) syscall_exit_to_user_mode (kernel/entry/common.c:296) do_syscall_64 (arch/x86/entry/common.c:86) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:106) Allocated by task 4719: kasan_save_stack (mm/kasan/common.c:45) __kasan_slab_alloc (mm/kasan/common.c:325) slab_post_alloc_hook (mm/slab.h:766) kmem_ca

Affected

20 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.11-1 (bookworm)linux 6.1.11-1 (bookworm)
linuxlinux
linuxlinux>= 3536da06db0baa675f32de608c0a4c0f5ef0e9ff < b09ae26f08aaf2d85f96ea7f90ddd3387f62216fb09ae26f08aaf2d85f96ea7f90ddd3387f62216f
linuxlinux>= 3536da06db0baa675f32de608c0a4c0f5ef0e9ff < 54f7be61584b8ec4c6df405f479495b9397bae4a54f7be61584b8ec4c6df405f479495b9397bae4a
linuxlinux>= 3536da06db0baa675f32de608c0a4c0f5ef0e9ff < a59cdbda3714e11aa3ab579132864c4c8c6d54f9a59cdbda3714e11aa3ab579132864c4c8c6d54f9
linuxlinux>= 3536da06db0baa675f32de608c0a4c0f5ef0e9ff < ad1baab3a5c03692d22ce446f38596a126377f6aad1baab3a5c03692d22ce446f38596a126377f6a
linuxlinux>= 3536da06db0baa675f32de608c0a4c0f5ef0e9ff < 7f129927feaf7c10b1c38bbce630172e9a08c8347f129927feaf7c10b1c38bbce630172e9a08c834
linuxlinux>= 3536da06db0baa675f32de608c0a4c0f5ef0e9ff < d3605282ec3502ec8847915eb2cf1f340493ff79d3605282ec3502ec8847915eb2cf1f340493ff79
linuxlinux>= 3536da06db0baa675f32de608c0a4c0f5ef0e9ff < 4bb4db7f3187c6e3de6b229ffc87cdb30a2d22b64bb4db7f3187c6e3de6b229ffc87cdb30a2d22b6
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.178-15.10.178-1
linuxlinux_kernel>= 0 < 6.1.11-16.1.11-1
linuxlinux_kernel>= 0 < 6.3.7-16.3.7-1
linuxlinux_kernel>= 0 < 6.3.7-16.3.7-1
linuxlinux_kernel>= 3.9 < 4.14.3054.14.305
linuxlinux_kernel>= 4.15 < 4.19.2724.19.272
linuxlinux_kernel>= 4.20 < 5.4.2315.4.231
linuxlinux_kernel>= 5.11 < 5.15.915.15.91
linuxlinux_kernel>= 5.16 < 6.1.96.1.9
linuxlinux_kernel>= 5.5 < 5.10.1665.10.166

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.