UBUNTU-CVE-2023-52885: Use After Free

Q: Which systems are most relevant to triage?

The issue is in the kernel SUNRPC TCP listener path and was reproduced while repeatedly stopping and starting rpc.nfsd and connecting to TCP port 2049. Ubuntu systems using the listed linux, linux-aws-fips, linux-azure, linux-azure-fips, linux-fips, linux-gcp, linux-gcp-fips, or linux-oracle kernel packages should be reviewed.

Q: What conditions are needed to trigger the race?

The race occurs when a listener svc_sock is freed before svc_tcp_accept() processes an established child socket that inherited the listener through sk_user_data. Data must then arrive on that child socket during the race window; the provided reproduction repeatedly restarts rpc.nfsd while making local TCP connections to port 2049.

Q: How could this appear on an affected system?

The supplied diagnostic evidence is a KASAN slab-use-after-free report in svc_tcp_listen_data_ready in the sunrpc module. The shown stack includes tcp_data_queue and tcp_rcv_established, with the access occurring while processing received TCP data.

Published Jul 14, 2024

Updated

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svctcplistendataready() After the listener svcsock is freed, and before invoking svctcpaccept() for the established child sock, there is a window that the newsock retaining a freed listener svcsock in skuserdata which cloning from parent. In the race window, if data is received on the newsock, we will observe use-after-free report in svctcplistendataready(). Reproduce by two tasks: 1. while :; do rpc.nfsd 0 ; rpc.nfsd; done 2. while :; do echo "" | ncat -4 127.0.0.1 2049 ; done KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in svctcplistendataready+0x1cf/0x1f0 [sunrpc] Read of size 8 at addr ffff888139d96228 by task nc/102553 CPU: 7 PID: 102553 Comm: nc Not tainted 6.3.0+ #18 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace: <IRQ> dumpstacklvl+0x33/0x50 printaddressdescription.constprop.0+0x27/0x310 printreport+0x3e/0x70 kasanreport+0xae/0xe0 svctcplistendataready+0x1cf/0x1f0 [sunrpc] tcpdataqueue+0x9f4/0x20e0 tcprcvestablished+0x666/0x1f60 tcpv4dorcv+0x51c/0x850 tcpv4rcv+0x23fc/0x2e80 ipprotocoldeliverrcu+0x62/0x300 iplocaldeliverfinish+0x267/0x350 iplocaldeliver+0x18b/0x2d0 iprcv+0x2fb/0x370 netifreceiveskbonecore+0x166/0x1b0 processbacklog+0x24c/0x5e0 napipoll+0xa2/0x500 netrxaction+0x854/0xc90 dosoftirq+0x1bb/0x5de dosoftirq+0xcb/0x100 </IRQ> <TASK> ... </TASK> Allocated by task 102371: kasansavestack+0x1e/0x40 kasansettrack+0x21/0x30 kasankmalloc+0x7b/0x90 svcsetupsocket+0x52/0x4f0 [sunrpc] svcaddsock+0x20d/0x400 [sunrpc] writeportsaddfd+0x209/0x390 [nfsd] writeports+0x239/0x2c0 [nfsd] nfsctltransactionwrite+0xac/0x110 [nfsd] vfswrite+0x1c3/0xae0 ksyswrite+0xed/0x1c0 dosyscall64+0x38/0x90 entrySYSCALL64afterhwframe+0x72/0xdc Freed by task 102551: kasansavestack+0x1e/0x40 kasansettrack+0x21/0x30 kasansavefreeinfo+0x2a/0x50 kasanslabfree+0x106/0x190 kmemcachefree+0x133/0x270 svcxprtfree+0x1e2/0x350 [sunrpc] svcxprtdestroyall+0x25a/0x440 [sunrpc] nfsdput+0x125/0x240 [nfsd] nfsdsvc+0x2cb/0x3c0 [nfsd] writethreads+0x1ac/0x2a0 [nfsd] nfsctltransactionwrite+0xac/0x110 [nfsd] vfswrite+0x1c3/0xae0 ksyswrite+0xed/0x1c0 dosyscall64+0x38/0x90 entrySYSCALL64afterhwframe+0x72/0xdc Fix the UAF by simply doing nothing in svctcplistendataready() if state != TCPLISTEN, that will avoid dereferencing svsk for all child socket.

Affected Software

147 affected componentsFixes available

ubuntu/linux-azure<4.15.0-1191.206~14.04.1

4.15.0-1191.206~14.04.1

ubuntu/linux-aws-hwe<4.15.0-1183.196~16.04.1

4.15.0-1183.196~16.04.1

ubuntu/linux-azure<4.15.0-1191.206~16.04.1

4.15.0-1191.206~16.04.1

ubuntu/linux-gcp<4.15.0-1176.193~16.04.1

4.15.0-1176.193~16.04.1

ubuntu/linux-hwe<4.15.0-240.252~16.04.1

4.15.0-240.252~16.04.1

ubuntu/linux-oracle<4.15.0-1145.156~16.04.1

4.15.0-1145.156~16.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux<4.15.0-240.252

4.15.0-240.252

ubuntu/linux-aws<4.15.0-1183.196

4.15.0-1183.196

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4<5.4.0-1113.123~18.04.1

5.4.0-1113.123~18.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-4.15<4.15.0-1191.206

4.15.0-1191.206

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4<5.4.0-1119.126~18.04.2

5.4.0-1119.126~18.04.2

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15<4.15.0-1176.193

4.15.0-1176.193

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4<5.4.0-1117.126~18.04.1

5.4.0-1117.126~18.04.1

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4<5.4.0-166.183~18.04.2

5.4.0-166.183~18.04.2

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4<5.4.0-1060.65~18.04.1

5.4.0-1060.65~18.04.1

ubuntu/linux-kvm<4.15.0-1166.171

4.15.0-1166.171

ubuntu/linux-oem*

ubuntu/linux-oracle<4.15.0-1145.156

4.15.0-1145.156

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4<5.4.0-1112.121~18.04.4

5.4.0-1112.121~18.04.4

ubuntu/linux-raspi-5.4<5.4.0-1097.109~18.04.2

5.4.0-1097.109~18.04.2

ubuntu/linux-aws-fips<4.15.0-2121.127

4.15.0-2121.127

ubuntu/linux-azure-fips<4.15.0-2100.106

4.15.0-2100.106

ubuntu/linux-fips<4.15.0-1138.149

4.15.0-1138.149

ubuntu/linux-gcp-fips<4.15.0-2084.90

4.15.0-2084.90

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.4.0-166.183

5.4.0-166.183

ubuntu/linux-aws<5.4.0-1113.123

5.4.0-1113.123

ubuntu/linux-aws-5.15<5.15.0-1047.52~20.04.1

5.15.0-1047.52~20.04.1

ubuntu/linux-azure<5.4.0-1119.126

5.4.0-1119.126

ubuntu/linux-azure-5.15<5.15.0-1049.56~20.04.1

5.15.0-1049.56~20.04.1

ubuntu/linux-bluefield<5.4.0-1074.80

5.4.0-1074.80

ubuntu/linux-gcp<5.4.0-1117.126

5.4.0-1117.126

ubuntu/linux-gcp-5.15<5.15.0-1044.52~20.04.1

5.15.0-1044.52~20.04.1

ubuntu/linux-gkeop<5.4.0-1080.84

5.4.0-1080.84

ubuntu/linux-gkeop-5.15<5.15.0-1030.35~20.04.1

5.15.0-1030.35~20.04.1

ubuntu/linux-hwe-5.15<5.15.0-86.96~20.04.1

5.15.0-86.96~20.04.1

ubuntu/linux-ibm<5.4.0-1060.65

5.4.0-1060.65

ubuntu/linux-ibm-5.15<5.15.0-1040.43~20.04.1

5.15.0-1040.43~20.04.1

ubuntu/linux-intel-iotg-5.15<5.15.0-1043.49~20.04.1

5.15.0-1043.49~20.04.1

ubuntu/linux-iot<5.4.0-1025.26

5.4.0-1025.26

ubuntu/linux-kvm<5.4.0-1102.108

5.4.0-1102.108

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-86.95~20.04.1

5.15.0-86.95~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1018.18~20.04.1

5.15.0-1018.18~20.04.1

ubuntu/linux-oracle<5.4.0-1112.121

5.4.0-1112.121

ubuntu/linux-oracle-5.15<5.15.0-1045.51~20.04.1

5.15.0-1045.51~20.04.1

ubuntu/linux-raspi<5.4.0-1097.109

5.4.0-1097.109

ubuntu/linux-riscv-5.15<5.15.0-1043.47~20.04.1

5.15.0-1043.47~20.04.1

ubuntu/linux-xilinx-zynqmp<5.4.0-1033.37

5.4.0-1033.37

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-aws-fips<5.4.0-1113.123+fips1

5.4.0-1113.123+fips1

ubuntu/linux-azure-fips<5.4.0-1119.126+fips1

5.4.0-1119.126+fips1

ubuntu/linux-fips<5.4.0-1088.97

5.4.0-1088.97

ubuntu/linux-gcp-fips<5.4.0-1117.126+fips1

5.4.0-1117.126+fips1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-86.96

5.15.0-86.96

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1047.52

5.15.0-1047.52

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-azure<5.15.0-1049.56

5.15.0-1049.56

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-fde<5.15.0-1049.56.1

5.15.0-1049.56.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp<5.15.0-1044.52

5.15.0-1044.52

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gke<5.15.0-1044.49

5.15.0-1044.49

ubuntu/linux-gkeop<5.15.0-1030.35

5.15.0-1030.35

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm<5.15.0-1040.43

5.15.0-1040.43

ubuntu/linux-intel-iotg<5.15.0-1043.49

5.15.0-1043.49

ubuntu/linux-kvm<5.15.0-1044.49

5.15.0-1044.49

ubuntu/linux-lowlatency<5.15.0-86.95

5.15.0-86.95

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia<5.15.0-1037.37

5.15.0-1037.37

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-tegra<5.15.0-1018.18

5.15.0-1018.18

ubuntu/linux-nvidia-tegra-igx<5.15.0-1005.5

5.15.0-1005.5

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oracle<5.15.0-1045.51

5.15.0-1045.51

ubuntu/linux-raspi<5.15.0-1040.43

5.15.0-1040.43

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-xilinx-zynqmp<5.15.0-1025.29

5.15.0-1025.29

ubuntu/linux-bluefield<5.15.0-1027.29

5.15.0-1027.29

ubuntu/linux-intel-iot-realtime<5.15.0-1040.42

5.15.0-1040.42

ubuntu/linux-realtime<5.15.0-1048.54

5.15.0-1048.54

ubuntu/linux-fips*

ubuntu/linux-raspi-realtime*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1191.206~14.04.1
Upgrade
Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-1183.196~16.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.15.0-1191.206~16.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.15.0-1176.193~16.04.1
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.15.0-240.252~16.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1145.156~16.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.15.0-240.252
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.15.0-1183.196
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1113.123~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1191.206
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1119.126~18.04.2
Upgrade
Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.
Fixed in 4.15.0-1176.193
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1117.126~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-166.183~18.04.2
Upgrade
Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1060.65~18.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.15.0-1166.171
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 4.15.0-1145.156
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1112.121~18.04.4
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1097.109~18.04.2
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2121.127
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2100.106
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-1138.149
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 4.15.0-2084.90
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-166.183
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1113.123
Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1047.52~20.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1119.126
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1049.56~20.04.1
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1074.80
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1117.126
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1044.52~20.04.1
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.4.0-1080.84
Upgrade
Upgrade ubuntu/linux-gkeop-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1030.35~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-86.96~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1060.65
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1040.43~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1043.49~20.04.1
Upgrade
Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.
Fixed in 5.4.0-1025.26
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1102.108
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-86.95~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1018.18~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1112.121
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1045.51~20.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1097.109
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1043.47~20.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.4.0-1033.37
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1113.123+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1119.126+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1088.97
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1117.126+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-86.96
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1047.52
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1049.56
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1049.56.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1044.52
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1044.49
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1030.35
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1040.43
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1043.49
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1044.49
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-86.95
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1037.37
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1018.18
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1005.5
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1045.51
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1040.43
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1025.29
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1027.29
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1040.42
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1048.54

Event History

Jul 14, 2024

CVE Published

via OSV·08:15 AM

Data Sourced

via OSV·08:15 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are most relevant to triage?

The issue is in the kernel SUNRPC TCP listener path and was reproduced while repeatedly stopping and starting rpc.nfsd and connecting to TCP port 2049. Ubuntu systems using the listed linux, linux-aws-fips, linux-azure, linux-azure-fips, linux-fips, linux-gcp, linux-gcp-fips, or linux-oracle kernel packages should be reviewed.

What conditions are needed to trigger the race?

The race occurs when a listener svc_sock is freed before svc_tcp_accept() processes an established child socket that inherited the listener through sk_user_data. Data must then arrive on that child socket during the race window; the provided reproduction repeatedly restarts rpc.nfsd while making local TCP connections to port 2049.

How could this appear on an affected system?

The supplied diagnostic evidence is a KASAN slab-use-after-free report in svc_tcp_listen_data_ready in the sunrpc module. The shown stack includes tcp_data_queue and tcp_rcv_established, with the access occurring while processing received TCP data.

UBUNTU-CVE-2023-52885: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are most relevant to triage?

What conditions are needed to trigger the race?

How could this appear on an affected system?

Company

Resources

Contact

Frequently Asked Questions

Which systems are most relevant to triage?

What conditions are needed to trigger the race?

How could this appear on an affected system?