CVE-2023-53867 — Time-of-check Time-of-use (TOCTOU) Race Condition in Linux
Severity
5.5MEDIUM
No vectorEPSS
0.0%
top 92.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 24
Description
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix potential use-after-free bug when trimming caps
When trimming the caps and just after the 'session->s_cap_lock' is
released in ceph_iterate_session_caps() the cap maybe removed by
another thread, and when using the stale cap memory in the callbacks
it will trigger use-after-free crash.
We need to check the existence of the cap just after the 'ci->i_ceph_lock'
being acquired. And do nothing if it's already removed.
Affected Packages4 packages
▶CVEListV5linux/linux2f2dc053404febedc9c273452d9d518fb31fde72 — 2b2515b8095cf2149bef44383a99d5b5677f1831+4
🔴Vulnerability Details
3GHSA▶
GHSA-f688-j3hq-jm53: In the Linux kernel, the following vulnerability has been resolved:
ceph: fix potential use-after-free bug when trimming caps
When trimming the caps↗2025-12-24
OSV▶
CVE-2023-53867: In the Linux kernel, the following vulnerability has been resolved: ceph: fix potential use-after-free bug when trimming caps When trimming the caps a↗2025-12-24