FKIE_CVE-2023-52654

Vulnerability from fkie_nvd - Published: 2024-05-14 14:23 - Updated: 2026-08-04 10:18
Severity
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.7 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: io_uring/af_unix: disable sending io_uring over sockets File reference cycles have caused lots of problems for io_uring in the past, and it still doesn't work exactly right and races with unix_stream_read_generic(). The safest fix would be to completely disallow sending io_uring files via sockets via SCM_RIGHT, so there are no possible cycles invloving registered files and thus rendering SCM accounting on the io_uring side unnecessary.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/18824f592aad4124d79751bbc1500ea86ac3ff29Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3fe1ea5f921bf5b71cbfdc4469fb96c05936610ePatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5a33d385eb36991a91e3dddb189d8679e2aac2bePatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/705318a99a138c29a512a72c3e0043b3cd7f55f4Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bcedd497b3b4a0be56f3adf7c7542720eced0792Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f2f57f51b53be153a522300454ddb3887722fb2cPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/18824f592aad4124d79751bbc1500ea86ac3ff29Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/3fe1ea5f921bf5b71cbfdc4469fb96c05936610ePatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/5a33d385eb36991a91e3dddb189d8679e2aac2bePatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/705318a99a138c29a512a72c3e0043b3cd7f55f4Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/bcedd497b3b4a0be56f3adf7c7542720eced0792Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/f2f57f51b53be153a522300454ddb3887722fb2cPatch
Impacted products
Vendor Product Version
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel *
linux linux_kernel 6.7
linux linux_kernel 6.7
linux linux_kernel 6.7
linux linux_kernel 6.7
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/rsrc.h",
            "net/core/scm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "18824f592aad4124d79751bbc1500ea86ac3ff29",
              "status": "affected",
              "version": "04df9719df1865f6770af9bc7880874af0e594b2",
              "versionType": "git"
            },
            {
              "lessThan": "3fe1ea5f921bf5b71cbfdc4469fb96c05936610e",
              "status": "affected",
              "version": "c378c479c5175833bb22ff71974cda47d7b05401",
              "versionType": "git"
            },
            {
              "lessThan": "bcedd497b3b4a0be56f3adf7c7542720eced0792",
              "status": "affected",
              "version": "813d8fe5d30388f73a21d3a2bf46b0a1fd72498c",
              "versionType": "git"
            },
            {
              "lessThan": "f2f57f51b53be153a522300454ddb3887722fb2c",
              "status": "affected",
              "version": "0091bfc81741b8d3aeb3b7ab8636f911b2de6e80",
              "versionType": "git"
            },
            {
              "lessThan": "5a33d385eb36991a91e3dddb189d8679e2aac2be",
              "status": "affected",
              "version": "0091bfc81741b8d3aeb3b7ab8636f911b2de6e80",
              "versionType": "git"
            },
            {
              "lessThan": "705318a99a138c29a512a72c3e0043b3cd7f55f4",
              "status": "affected",
              "version": "0091bfc81741b8d3aeb3b7ab8636f911b2de6e80",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b4293c01ee0d0ecdd3cb5801e13f62271144667a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75e94c7e8859e58aadc15a98cc9704edff47d4f2",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.264",
              "status": "affected",
              "version": "5.4.220",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.204",
              "status": "affected",
              "version": "5.10.150",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.143",
              "status": "affected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThan": "5.20",
              "status": "affected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "io_uring/rsrc.h",
            "net/core/scm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.264",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.204",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.68",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.7",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7E2C4C68-2F88-4106-AD66-FA8891A907E3",
              "versionEndExcluding": "5.4.264",
              "versionStartIncluding": "5.4.220",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "576AA0C2-EAA1-48A0-ABBF-A2B91887A533",
              "versionEndExcluding": "5.10.204",
              "versionStartIncluding": "5.10.150",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD6CB4C0-2F8D-4BED-9163-932088CD13D1",
              "versionEndExcluding": "5.15.143",
              "versionStartIncluding": "5.15.75",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "79FE0F04-9BE6-40F3-AA03-5DE7796C34A7",
              "versionEndExcluding": "5.20",
              "versionStartIncluding": "5.19.17",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C18ACF08-BC01-4909-A899-7B8AE346ECA6",
              "versionEndExcluding": "6.1.68",
              "versionStartIncluding": "6.0.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "38CB764D-606E-4695-8437-DD35E0B1A6FC",
              "versionEndExcluding": "6.6.7",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.7:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "3A0038DE-E183-4958-A6E3-CE3821FEAFBF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.7:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "E31AD4FC-436C-44AB-BCAB-3A0B37F69EE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.7:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "C56C6E04-4F04-44A3-8DB8-93899903CFCF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.7:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "5C78EDA4-8BE6-42FC-9512-49032D525A55",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/af_unix: disable sending io_uring over sockets\n\nFile reference cycles have caused lots of problems for io_uring\nin the past, and it still doesn\u0027t work exactly right and races with\nunix_stream_read_generic(). The safest fix would be to completely\ndisallow sending io_uring files via sockets via SCM_RIGHT, so there\nare no possible cycles invloving registered files and thus rendering\nSCM accounting on the io_uring side unnecessary."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: io_uring/af_unix: deshabilita el env\u00edo de io_uring a trav\u00e9s de sockets Los ciclos de referencia de archivos han causado muchos problemas para io_uring en el pasado, y todav\u00eda no funciona exactamente correctamente y corre con unix_stream_read_generic(). La soluci\u00f3n m\u00e1s segura ser\u00eda no permitir por completo el env\u00edo de archivos io_uring a trav\u00e9s de sockets a trav\u00e9s de SCM_RIGHT, de modo que no haya ciclos posibles que involucren archivos registrados y, por lo tanto, hagan innecesaria la contabilidad SCM en el lado io_uring."
    }
  ],
  "id": "CVE-2023-52654",
  "lastModified": "2026-08-04T10:18:36.427",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-52654",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-05-09T18:37:06.033789Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-05-14T14:23:13.130",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/18824f592aad4124d79751bbc1500ea86ac3ff29"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/3fe1ea5f921bf5b71cbfdc4469fb96c05936610e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5a33d385eb36991a91e3dddb189d8679e2aac2be"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/705318a99a138c29a512a72c3e0043b3cd7f55f4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/bcedd497b3b4a0be56f3adf7c7542720eced0792"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/f2f57f51b53be153a522300454ddb3887722fb2c"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/18824f592aad4124d79751bbc1500ea86ac3ff29"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/3fe1ea5f921bf5b71cbfdc4469fb96c05936610e"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/5a33d385eb36991a91e3dddb189d8679e2aac2be"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/705318a99a138c29a512a72c3e0043b3cd7f55f4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/bcedd497b3b4a0be56f3adf7c7542720eced0792"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/f2f57f51b53be153a522300454ddb3887722fb2c"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.