CVE-2023-52885

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Fix UAF in svc_tcp_listen_data_ready()

After the listener svc_sock is freed, and before invoking svc_tcp_accept()

for the established child sock, there is a window that the newsock

retaining a freed listener svc_sock in sk_user_data which cloning from

parent. In the race window, if data is received on the newsock, we will

observe use-after-free report in svc_tcp_listen_data_ready().

Reproduce by two tasks:

1. while :; do rpc.nfsd 0 ; rpc.nfsd; done

2. while :; do echo "" | ncat -4 127.0.0.1 2049 ; done

KASAN report:

==================================================================

BUG: KASAN: slab-use-after-free in svc_tcp_listen_data_ready+0x1cf/0x1f0 [sunrpc]

Read of size 8 at addr ffff888139d96228 by task nc/102553

CPU: 7 PID: 102553 Comm: nc Not tainted 6.3.0+ #18

Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020

Call Trace:

<IRQ

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References