CVE-2023-53083
published 2025-05-02CVE-2023-53083: In the Linux kernel, the following vulnerability has been resolved: nfsd: don't replace page in rq_pages if it's a continuation of last page The splice read…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.47%
38.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
nfsd: don't replace page in rq_pages if it's a continuation of last page
The splice read calls nfsd_splice_actor to put the pages containing file
data into the svc_rqst->rq_pages array. It's possible however to get a
splice result that only has a partial page at the end, if (e.g.) the
filesystem hands back a short read that doesn't cover the whole page.
nfsd_splice_actor will plop the partial page into its rq_pages array and
return. Then later, when nfsd_splice_actor is called again, the
remainder of the page may end up being filled out. At this point,
nfsd_splice_actor will put the page into the array _again_ corrupting
the reply. If this is done enough times, rq_next_page will overrun the
array and corrupt the trailing fields -- the rq_respages and
rq_next_page pointers themselves.
If we've already added the page to the array in the last pass, don't add
it to the array a second time when dealing with a splice continuation.
This was originally handled properly in nfsd_splice_actor, but commit
91e23b1c3982 ("NFSD: Clean up nfsd_splice_actor()") removed the check
for it.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.25-1 (bookworm) | linux 6.1.25-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 56bc7e3821e847a6cc8027ddaba32e9a440225a5 < 12eca509234acb6b666802edf77408bb70d7bfca | 12eca509234acb6b666802edf77408bb70d7bfca |
| linux | linux | >= 91e23b1c39820bfed642119ff6b6ef9f43cf09ce < 51ddb84baff6f09ad62b5999ece3ec172e4e3568 | 51ddb84baff6f09ad62b5999ece3ec172e4e3568 |
| linux | linux | >= 91e23b1c39820bfed642119ff6b6ef9f43cf09ce < 0101067f376eb7b9afd00279270f25d5111a091d | 0101067f376eb7b9afd00279270f25d5111a091d |
| linux | linux | >= 91e23b1c39820bfed642119ff6b6ef9f43cf09ce < 27c934dd8832dd40fd34776f916dc201e18b319b | 27c934dd8832dd40fd34776f916dc201e18b319b |
| linux | linux | >= bf1cbe2f3650b4f4a8add6af933c6d7f6af1f361 < 8235cd619db6e67f1d7d26c55f1f3e4e575c947d | 8235cd619db6e67f1d7d26c55f1f3e4e575c947d |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.221-1 | 5.10.221-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 0 < 6.1.25-1 | 6.1.25-1 |
| linux | linux_kernel | >= 5.19 < 6.1.22 | 6.1.22 |
| linux | linux_kernel | >= 6.2 < 6.2.9 | 6.2.9 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: nfsd: don't replace page in rq_pages if it's a continuation of last page
vendor_redhat·2025-05-02·CVSS 5.5
CVE-2023-53083 [MEDIUM] kernel: nfsd: don't replace page in rq_pages if it's a continuation of last page
kernel: nfsd: don't replace page in rq_pages if it's a continuation of last page
In the Linux kernel, the following vulnerability has been resolved:
nfsd: don't replace page in rq_pages if it's a continuation of last page
The splice read calls nfsd_splice_actor to put the pages containing file
data into the svc_rqst->rq_pages array. It's possible however to get a
splice result that only has a partial page at the end, if (e.g.) the
filesystem hands back a short read that doesn't cover the whole page.
nfsd_splice_actor will plop the partial page into its rq_pages array and
return. Then later, when nfsd_splice_actor is called again, the
remainder of the page may end up being filled out. At this point,
nfsd_splice_actor will put the page into the array _again_ corrupting
the reply. If this is
Debian
CVE-2023-53083: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: don't...
vendor_debian·2023·CVSS 5.5
CVE-2023-53083 [MEDIUM] CVE-2023-53083: linux - In the Linux kernel, the following vulnerability has been resolved: nfsd: don't...
In the Linux kernel, the following vulnerability has been resolved: nfsd: don't replace page in rq_pages if it's a continuation of last page The splice read calls nfsd_splice_actor to put the pages containing file data into the svc_rqst->rq_pages array. It's possible however to get a splice result that only has a partial page at the end, if (e.g.) the filesystem hands back a short read that doesn't cover the whole page. nfsd_splice_actor will plop the partial page into its rq_pages array and return. Then later, when nfsd_splice_actor is called again, the remainder of the page may end up being filled out. At this point, nfsd_splice_actor will put the page into the array _again_ corrupting the reply. If this is done enough times, rq_next_page will overrun the array and corrupt the trailing f
GHSA
GHSA-7wgq-p9vg-wmw2: In the Linux kernel, the following vulnerability has been resolved:
nfsd: don't replace page in rq_pages if it's a continuation of last page
The spl
ghsa_unreviewed·2025-05-02
CVE-2023-53083 [MEDIUM] GHSA-7wgq-p9vg-wmw2: In the Linux kernel, the following vulnerability has been resolved:
nfsd: don't replace page in rq_pages if it's a continuation of last page
The spl
In the Linux kernel, the following vulnerability has been resolved:
nfsd: don't replace page in rq_pages if it's a continuation of last page
The splice read calls nfsd_splice_actor to put the pages containing file
data into the svc_rqst->rq_pages array. It's possible however to get a
splice result that only has a partial page at the end, if (e.g.) the
filesystem hands back a short read that doesn't cover the whole page.
nfsd_splice_actor will plop the partial page into its rq_pages array and
return. Then later, when nfsd_splice_actor is called again, the
remainder of the page may end up being filled out. At this point,
nfsd_splice_actor will put the page into the array _again_ corrupting
the reply. If this is done enough times, rq_next_page will overrun the
array and corrupt the trailin
OSV
CVE-2023-53083: In the Linux kernel, the following vulnerability has been resolved: nfsd: don't replace page in rq_pages if it's a continuation of last page The splic
osv·2025-05-02·CVSS 5.5
CVE-2023-53083 [MEDIUM] CVE-2023-53083: In the Linux kernel, the following vulnerability has been resolved: nfsd: don't replace page in rq_pages if it's a continuation of last page The splic
In the Linux kernel, the following vulnerability has been resolved: nfsd: don't replace page in rq_pages if it's a continuation of last page The splice read calls nfsd_splice_actor to put the pages containing file data into the svc_rqst->rq_pages array. It's possible however to get a splice result that only has a partial page at the end, if (e.g.) the filesystem hands back a short read that doesn't cover the whole page. nfsd_splice_actor will plop the partial page into its rq_pages array and return. Then later, when nfsd_splice_actor is called again, the remainder of the page may end up being filled out. At this point, nfsd_splice_actor will put the page into the array _again_ corrupting the reply. If this is done enough times, rq_next_page will overrun the array and corrupt the trailing f
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0101067f376eb7b9afd00279270f25d5111a091dhttps://git.kernel.org/stable/c/12eca509234acb6b666802edf77408bb70d7bfcahttps://git.kernel.org/stable/c/27c934dd8832dd40fd34776f916dc201e18b319bhttps://git.kernel.org/stable/c/51ddb84baff6f09ad62b5999ece3ec172e4e3568https://git.kernel.org/stable/c/8235cd619db6e67f1d7d26c55f1f3e4e575c947d
2025-05-02
Published