GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-52803 (GCVE-0-2023-52803)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:31 – Updated: 2026-05-11 19:33
VLAI
Title
SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
Summary
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir() workqueue,which takes care about pipefs superblock locking. In some special scenarios, when kernel frees the pipefs sb of the current client and immediately alloctes a new pipefs sb, rpc_remove_pipedir function would misjudge the existence of pipefs sb which is not the one it used to hold. As a result, the rpc_remove_pipedir would clean the released freed pipefs dentries. To fix this issue, rpc_remove_pipedir should check whether the current pipefs sb is consistent with the original pipefs sb. This error can be catched by KASAN: ========================================================= [ 250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200 [ 250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503 [ 250.500549] Workqueue: events rpc_free_client_work [ 250.501001] Call Trace: [ 250.502880] kasan_report+0xb6/0xf0 [ 250.503209] ? dget_parent+0x195/0x200 [ 250.503561] dget_parent+0x195/0x200 [ 250.503897] ? __pfx_rpc_clntdir_depopulate+0x10/0x10 [ 250.504384] rpc_rmdir_depopulate+0x1b/0x90 [ 250.504781] rpc_remove_client_dir+0xf5/0x150 [ 250.505195] rpc_free_client_work+0xe4/0x230 [ 250.505598] process_one_work+0x8ee/0x13b0 ... [ 22.039056] Allocated by task 244: [ 22.039390] kasan_save_stack+0x22/0x50 [ 22.039758] kasan_set_track+0x25/0x30 [ 22.040109] __kasan_slab_alloc+0x59/0x70 [ 22.040487] kmem_cache_alloc_lru+0xf0/0x240 [ 22.040889] __d_alloc+0x31/0x8e0 [ 22.041207] d_alloc+0x44/0x1f0 [ 22.041514] __rpc_lookup_create_exclusive+0x11c/0x140 [ 22.041987] rpc_mkdir_populate.constprop.0+0x5f/0x110 [ 22.042459] rpc_create_client_dir+0x34/0x150 [ 22.042874] rpc_setup_pipedir_sb+0x102/0x1c0 [ 22.043284] rpc_client_register+0x136/0x4e0 [ 22.043689] rpc_new_client+0x911/0x1020 [ 22.044057] rpc_create_xprt+0xcb/0x370 [ 22.044417] rpc_create+0x36b/0x6c0 ... [ 22.049524] Freed by task 0: [ 22.049803] kasan_save_stack+0x22/0x50 [ 22.050165] kasan_set_track+0x25/0x30 [ 22.050520] kasan_save_free_info+0x2b/0x50 [ 22.050921] __kasan_slab_free+0x10e/0x1a0 [ 22.051306] kmem_cache_free+0xa5/0x390 [ 22.051667] rcu_core+0x62c/0x1930 [ 22.051995] __do_softirq+0x165/0x52a [ 22.052347] [ 22.052503] Last potentially related work creation: [ 22.052952] kasan_save_stack+0x22/0x50 [ 22.053313] __kasan_record_aux_stack+0x8e/0xa0 [ 22.053739] __call_rcu_common.constprop.0+0x6b/0x8b0 [ 22.054209] dentry_free+0xb2/0x140 [ 22.054540] __dentry_kill+0x3be/0x540 [ 22.054900] shrink_dentry_list+0x199/0x510 [ 22.055293] shrink_dcache_parent+0x190/0x240 [ 22.055703] do_one_tree+0x11/0x40 [ 22.056028] shrink_dcache_for_umount+0x61/0x140 [ 22.056461] generic_shutdown_super+0x70/0x590 [ 22.056879] kill_anon_super+0x3a/0x60 [ 22.057234] rpc_kill_sb+0x121/0x200
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-17 17:36 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0157d021d23a087eecfa830502f81cfe843f0d16 , < 17866066b8ac1cc38fb449670bc15dc9fee4b40a (git)
Affected: 0157d021d23a087eecfa830502f81cfe843f0d16 , < 7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5 (git)
Affected: 0157d021d23a087eecfa830502f81cfe843f0d16 , < dedf2a0eb9448ae73b270743e6ea9b108189df46 (git)
Affected: 0157d021d23a087eecfa830502f81cfe843f0d16 , < 194454afa6aa9d6ed74f0c57127bc8beb27c20df (git)
Affected: 0157d021d23a087eecfa830502f81cfe843f0d16 , < 7749fd2dbef72a52b5c9ffdbf877691950ed4680 (git)
Affected: 0157d021d23a087eecfa830502f81cfe843f0d16 , < 1cdb52ffd6600a37bd355d8dce58ecd03e55e618 (git)
Affected: 0157d021d23a087eecfa830502f81cfe843f0d16 , < cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a (git)
Affected: 0157d021d23a087eecfa830502f81cfe843f0d16 , < bfca5fb4e97c46503ddfc582335917b0cc228264 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.4
Unaffected: 0 , < 3.4 (semver)
Unaffected: 4.19.318 , ≤ 4.19.* (semver)
Unaffected: 5.4.280 , ≤ 5.4.* (semver)
Unaffected: 5.10.202 , ≤ 5.10.* (semver)
Unaffected: 5.15.140 , ≤ 5.15.* (semver)
Unaffected: 6.1.64 , ≤ 6.1.* (semver)
Unaffected: 6.5.13 , ≤ 6.5.* (semver)
Unaffected: 6.6.3 , ≤ 6.6.* (semver)
Unaffected: 6.7 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52803",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:36:49.719946Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:37:08.071Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:35.893Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/17866066b8ac1cc38fb449670bc15dc9fee4b40a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dedf2a0eb9448ae73b270743e6ea9b108189df46"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/194454afa6aa9d6ed74f0c57127bc8beb27c20df"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7749fd2dbef72a52b5c9ffdbf877691950ed4680"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1cdb52ffd6600a37bd355d8dce58ecd03e55e618"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bfca5fb4e97c46503ddfc582335917b0cc228264"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/sunrpc/clnt.h",
            "net/sunrpc/clnt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "17866066b8ac1cc38fb449670bc15dc9fee4b40a",
              "status": "affected",
              "version": "0157d021d23a087eecfa830502f81cfe843f0d16",
              "versionType": "git"
            },
            {
              "lessThan": "7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5",
              "status": "affected",
              "version": "0157d021d23a087eecfa830502f81cfe843f0d16",
              "versionType": "git"
            },
            {
              "lessThan": "dedf2a0eb9448ae73b270743e6ea9b108189df46",
              "status": "affected",
              "version": "0157d021d23a087eecfa830502f81cfe843f0d16",
              "versionType": "git"
            },
            {
              "lessThan": "194454afa6aa9d6ed74f0c57127bc8beb27c20df",
              "status": "affected",
              "version": "0157d021d23a087eecfa830502f81cfe843f0d16",
              "versionType": "git"
            },
            {
              "lessThan": "7749fd2dbef72a52b5c9ffdbf877691950ed4680",
              "status": "affected",
              "version": "0157d021d23a087eecfa830502f81cfe843f0d16",
              "versionType": "git"
            },
            {
              "lessThan": "1cdb52ffd6600a37bd355d8dce58ecd03e55e618",
              "status": "affected",
              "version": "0157d021d23a087eecfa830502f81cfe843f0d16",
              "versionType": "git"
            },
            {
              "lessThan": "cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a",
              "status": "affected",
              "version": "0157d021d23a087eecfa830502f81cfe843f0d16",
              "versionType": "git"
            },
            {
              "lessThan": "bfca5fb4e97c46503ddfc582335917b0cc228264",
              "status": "affected",
              "version": "0157d021d23a087eecfa830502f81cfe843f0d16",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/sunrpc/clnt.h",
            "net/sunrpc/clnt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.4"
            },
            {
              "lessThan": "3.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.318",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.280",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.7",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.318",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.280",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.202",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.140",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.64",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.13",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.3",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix RPC client cleaned up the freed pipefs dentries\n\nRPC client pipefs dentries cleanup is in separated rpc_remove_pipedir()\nworkqueue,which takes care about pipefs superblock locking.\nIn some special scenarios, when kernel frees the pipefs sb of the\ncurrent client and immediately alloctes a new pipefs sb,\nrpc_remove_pipedir function would misjudge the existence of pipefs\nsb which is not the one it used to hold. As a result,\nthe rpc_remove_pipedir would clean the released freed pipefs dentries.\n\nTo fix this issue, rpc_remove_pipedir should check whether the\ncurrent pipefs sb is consistent with the original pipefs sb.\n\nThis error can be catched by KASAN:\n=========================================================\n[  250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200\n[  250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503\n[  250.500549] Workqueue: events rpc_free_client_work\n[  250.501001] Call Trace:\n[  250.502880]  kasan_report+0xb6/0xf0\n[  250.503209]  ? dget_parent+0x195/0x200\n[  250.503561]  dget_parent+0x195/0x200\n[  250.503897]  ? __pfx_rpc_clntdir_depopulate+0x10/0x10\n[  250.504384]  rpc_rmdir_depopulate+0x1b/0x90\n[  250.504781]  rpc_remove_client_dir+0xf5/0x150\n[  250.505195]  rpc_free_client_work+0xe4/0x230\n[  250.505598]  process_one_work+0x8ee/0x13b0\n...\n[   22.039056] Allocated by task 244:\n[   22.039390]  kasan_save_stack+0x22/0x50\n[   22.039758]  kasan_set_track+0x25/0x30\n[   22.040109]  __kasan_slab_alloc+0x59/0x70\n[   22.040487]  kmem_cache_alloc_lru+0xf0/0x240\n[   22.040889]  __d_alloc+0x31/0x8e0\n[   22.041207]  d_alloc+0x44/0x1f0\n[   22.041514]  __rpc_lookup_create_exclusive+0x11c/0x140\n[   22.041987]  rpc_mkdir_populate.constprop.0+0x5f/0x110\n[   22.042459]  rpc_create_client_dir+0x34/0x150\n[   22.042874]  rpc_setup_pipedir_sb+0x102/0x1c0\n[   22.043284]  rpc_client_register+0x136/0x4e0\n[   22.043689]  rpc_new_client+0x911/0x1020\n[   22.044057]  rpc_create_xprt+0xcb/0x370\n[   22.044417]  rpc_create+0x36b/0x6c0\n...\n[   22.049524] Freed by task 0:\n[   22.049803]  kasan_save_stack+0x22/0x50\n[   22.050165]  kasan_set_track+0x25/0x30\n[   22.050520]  kasan_save_free_info+0x2b/0x50\n[   22.050921]  __kasan_slab_free+0x10e/0x1a0\n[   22.051306]  kmem_cache_free+0xa5/0x390\n[   22.051667]  rcu_core+0x62c/0x1930\n[   22.051995]  __do_softirq+0x165/0x52a\n[   22.052347]\n[   22.052503] Last potentially related work creation:\n[   22.052952]  kasan_save_stack+0x22/0x50\n[   22.053313]  __kasan_record_aux_stack+0x8e/0xa0\n[   22.053739]  __call_rcu_common.constprop.0+0x6b/0x8b0\n[   22.054209]  dentry_free+0xb2/0x140\n[   22.054540]  __dentry_kill+0x3be/0x540\n[   22.054900]  shrink_dentry_list+0x199/0x510\n[   22.055293]  shrink_dcache_parent+0x190/0x240\n[   22.055703]  do_one_tree+0x11/0x40\n[   22.056028]  shrink_dcache_for_umount+0x61/0x140\n[   22.056461]  generic_shutdown_super+0x70/0x590\n[   22.056879]  kill_anon_super+0x3a/0x60\n[   22.057234]  rpc_kill_sb+0x121/0x200"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:33:24.871Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/17866066b8ac1cc38fb449670bc15dc9fee4b40a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/dedf2a0eb9448ae73b270743e6ea9b108189df46"
        },
        {
          "url": "https://git.kernel.org/stable/c/194454afa6aa9d6ed74f0c57127bc8beb27c20df"
        },
        {
          "url": "https://git.kernel.org/stable/c/7749fd2dbef72a52b5c9ffdbf877691950ed4680"
        },
        {
          "url": "https://git.kernel.org/stable/c/1cdb52ffd6600a37bd355d8dce58ecd03e55e618"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfca5fb4e97c46503ddfc582335917b0cc228264"
        }
      ],
      "title": "SUNRPC: Fix RPC client cleaned up the freed pipefs dentries",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52803",
    "datePublished": "2024-05-21T15:31:15.063Z",
    "dateReserved": "2024-05-21T15:19:24.247Z",
    "dateUpdated": "2026-05-11T19:33:24.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52803",
      "date": "2026-09-16",
      "epss": "0.00236",
      "percentile": "0.1471"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nSUNRPC: Fix RPC client cleaned up the freed pipefs dentries\\n\\nRPC client pipefs dentries cleanup is in separated rpc_remove_pipedir()\\nworkqueue,which takes care about pipefs superblock locking.\\nIn some special scenarios, when kernel frees the pipefs sb of the\\ncurrent client and immediately alloctes a new pipefs sb,\\nrpc_remove_pipedir function would misjudge the existence of pipefs\\nsb which is not the one it used to hold. As a result,\\nthe rpc_remove_pipedir would clean the released freed pipefs dentries.\\n\\nTo fix this issue, rpc_remove_pipedir should check whether the\\ncurrent pipefs sb is consistent with the original pipefs sb.\\n\\nThis error can be catched by KASAN:\\n=========================================================\\n[  250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200\\n[  250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503\\n[  250.500549] Workqueue: events rpc_free_client_work\\n[  250.501001] Call Trace:\\n[  250.502880]  kasan_report+0xb6/0xf0\\n[  250.503209]  ? dget_parent+0x195/0x200\\n[  250.503561]  dget_parent+0x195/0x200\\n[  250.503897]  ? __pfx_rpc_clntdir_depopulate+0x10/0x10\\n[  250.504384]  rpc_rmdir_depopulate+0x1b/0x90\\n[  250.504781]  rpc_remove_client_dir+0xf5/0x150\\n[  250.505195]  rpc_free_client_work+0xe4/0x230\\n[  250.505598]  process_one_work+0x8ee/0x13b0\\n...\\n[   22.039056] Allocated by task 244:\\n[   22.039390]  kasan_save_stack+0x22/0x50\\n[   22.039758]  kasan_set_track+0x25/0x30\\n[   22.040109]  __kasan_slab_alloc+0x59/0x70\\n[   22.040487]  kmem_cache_alloc_lru+0xf0/0x240\\n[   22.040889]  __d_alloc+0x31/0x8e0\\n[   22.041207]  d_alloc+0x44/0x1f0\\n[   22.041514]  __rpc_lookup_create_exclusive+0x11c/0x140\\n[   22.041987]  rpc_mkdir_populate.constprop.0+0x5f/0x110\\n[   22.042459]  rpc_create_client_dir+0x34/0x150\\n[   22.042874]  rpc_setup_pipedir_sb+0x102/0x1c0\\n[   22.043284]  rpc_client_register+0x136/0x4e0\\n[   22.043689]  rpc_new_client+0x911/0x1020\\n[   22.044057]  rpc_create_xprt+0xcb/0x370\\n[   22.044417]  rpc_create+0x36b/0x6c0\\n...\\n[   22.049524] Freed by task 0:\\n[   22.049803]  kasan_save_stack+0x22/0x50\\n[   22.050165]  kasan_set_track+0x25/0x30\\n[   22.050520]  kasan_save_free_info+0x2b/0x50\\n[   22.050921]  __kasan_slab_free+0x10e/0x1a0\\n[   22.051306]  kmem_cache_free+0xa5/0x390\\n[   22.051667]  rcu_core+0x62c/0x1930\\n[   22.051995]  __do_softirq+0x165/0x52a\\n[   22.052347]\\n[   22.052503] Last potentially related work creation:\\n[   22.052952]  kasan_save_stack+0x22/0x50\\n[   22.053313]  __kasan_record_aux_stack+0x8e/0xa0\\n[   22.053739]  __call_rcu_common.constprop.0+0x6b/0x8b0\\n[   22.054209]  dentry_free+0xb2/0x140\\n[   22.054540]  __dentry_kill+0x3be/0x540\\n[   22.054900]  shrink_dentry_list+0x199/0x510\\n[   22.055293]  shrink_dcache_parent+0x190/0x240\\n[   22.055703]  do_one_tree+0x11/0x40\\n[   22.056028]  shrink_dcache_for_umount+0x61/0x140\\n[   22.056461]  generic_shutdown_super+0x70/0x590\\n[   22.056879]  kill_anon_super+0x3a/0x60\\n[   22.057234]  rpc_kill_sb+0x121/0x200\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: SUNRPC: el cliente RPC limpi\\u00f3 los pipefs dentries liberados. La limpieza de pipefs dentries del cliente RPC est\\u00e1 en la cola de trabajo separada rpc_remove_pipedir(), que se encarga del bloqueo del superbloque de pipefs. En algunos escenarios especiales, cuando el kernel libera el pipefs sb del cliente actual e inmediatamente asigna un nuevo pipefs sb, la funci\\u00f3n rpc_remove_pipedir juzgar\\u00eda mal la existencia de pipefs sb que no es el que sol\\u00eda contener. Como resultado, rpc_remove_pipedir limpiar\\u00eda las dentr\\u00edas de pipefs liberadas. Para solucionar este problema, rpc_remove_pipedir debe verificar si el pipefs sb actual es consistente con el pipefs sb original. KASAN puede detectar este error: ============================================ =============== [250.497700] BUG: KASAN: slab-use-after-free en dget_parent+0x195/0x200 [250.498315] Lectura de tama\\u00f1o 4 en la direcci\\u00f3n ffff88800a2ab804 por tarea kworker/0 :18/106503 [250.500549] Cola de trabajo: eventos rpc_free_client_work [250.501001] Seguimiento de llamadas: [250.502880] kasan_report+0xb6/0xf0 [250.503209]? dget_parent+0x195/0x200 [ 250.503561] dget_parent+0x195/0x200 [ 250.503897] ? __pfx_rpc_clntdir_depopulate+0x10/0x10 [ 250.504384] rpc_rmdir_depopulate+0x1b/0x90 [ 250.504781] rpc_remove_client_dir+0xf5/0x150 [ 250.505195] /0x230 [ 250.505598] Process_one_work+0x8ee/0x13b0 ... [ 22.039056] Asignado por la tarea 244: [ 22.039390 ] kasan_save_stack+0x22/0x50 [ 22.039758] kasan_set_track+0x25/0x30 [ 22.040109] __kasan_slab_alloc+0x59/0x70 [ 22.040487] kmem_cache_alloc_lru+0xf0/0x240 [ 22.0408 89] __d_alloc+0x31/0x8e0 [ 22.041207] d_alloc+0x44/0x1f0 [ 22.041514] __rpc_lookup_create_exclusive +0x11c/0x140 [ 22.041987] rpc_mkdir_populate.constprop.0+0x5f/0x110 [ 22.042459] rpc_create_client_dir+0x34/0x150 [ 22.042874] rpc_setup_pipedir_sb+0x102/0x1c0 [ 22.043284] rpc_client_register+0x136/0x4e0 [ 22.043689] rpc_new_client+0x911/0x1020 [ 22.044057 ] rpc_create_xprt+0xcb/0x370 [ 22.044417] rpc_create+0x36b/0x6c0 ... [ 22.049524] Liberado por la tarea 0: [ 22.049803] kasan_save_stack+0x22/0x50 [ 22.050165] 25/0x30 [ 22.050520] kasan_save_free_info+0x2b/0x50 [ 22.050921] __kasan_slab_free+0x10e/0x1a0 [ 22.051306] kmem_cache_free+0xa5/0x390 [ 22.051667] rcu_core+0x62c/0x1930 [ 22.051995] __do_softirq+0x165/0x52a [ 22.052347] [ 22.052503] \\u00daltima creaci\\u00f3n de trabajo potencialmente relacionado: [ 22.052952] kasan_save_stack+0x22/ 0x50 [ 22.053313] __kasan_record_aux_stack+0x8e/0xa0 [ 22.053739] __call_rcu_common.constprop.0+0x6b/0x8b0 [ 22.054209] dentry_free+0xb2/0x140 [ __dentry_kill+ 0x3be/0x540 [22.054900] Shrink_dentry_list+0x199/0x510 [22.055293] Shrink_dcache_parent+ 0x190/0x240 [ 22.055703] do_one_tree+0x11/0x40 [ 22.056028] shrink_dcache_for_umount+0x61/0x140 [ 22.056461] generic_shutdown_super+0x70/0x590 [ 22.056879] 3a/0x60 [22.057234] rpc_kill_sb+0x121/0x200\"}]",
      "id": "CVE-2023-52803",
      "lastModified": "2024-11-21T08:40:37.290",
      "published": "2024-05-21T16:15:18.753",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/17866066b8ac1cc38fb449670bc15dc9fee4b40a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/194454afa6aa9d6ed74f0c57127bc8beb27c20df\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/1cdb52ffd6600a37bd355d8dce58ecd03e55e618\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7749fd2dbef72a52b5c9ffdbf877691950ed4680\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/bfca5fb4e97c46503ddfc582335917b0cc228264\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/dedf2a0eb9448ae73b270743e6ea9b108189df46\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/17866066b8ac1cc38fb449670bc15dc9fee4b40a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/194454afa6aa9d6ed74f0c57127bc8beb27c20df\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/1cdb52ffd6600a37bd355d8dce58ecd03e55e618\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/7749fd2dbef72a52b5c9ffdbf877691950ed4680\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/bfca5fb4e97c46503ddfc582335917b0cc228264\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/dedf2a0eb9448ae73b270743e6ea9b108189df46\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52803\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T16:15:18.753\",\"lastModified\":\"2026-06-17T06:43:36.997\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nSUNRPC: Fix RPC client cleaned up the freed pipefs dentries\\n\\nRPC client pipefs dentries cleanup is in separated rpc_remove_pipedir()\\nworkqueue,which takes care about pipefs superblock locking.\\nIn some special scenarios, when kernel frees the pipefs sb of the\\ncurrent client and immediately alloctes a new pipefs sb,\\nrpc_remove_pipedir function would misjudge the existence of pipefs\\nsb which is not the one it used to hold. As a result,\\nthe rpc_remove_pipedir would clean the released freed pipefs dentries.\\n\\nTo fix this issue, rpc_remove_pipedir should check whether the\\ncurrent pipefs sb is consistent with the original pipefs sb.\\n\\nThis error can be catched by KASAN:\\n=========================================================\\n[  250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200\\n[  250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503\\n[  250.500549] Workqueue: events rpc_free_client_work\\n[  250.501001] Call Trace:\\n[  250.502880]  kasan_report+0xb6/0xf0\\n[  250.503209]  ? dget_parent+0x195/0x200\\n[  250.503561]  dget_parent+0x195/0x200\\n[  250.503897]  ? __pfx_rpc_clntdir_depopulate+0x10/0x10\\n[  250.504384]  rpc_rmdir_depopulate+0x1b/0x90\\n[  250.504781]  rpc_remove_client_dir+0xf5/0x150\\n[  250.505195]  rpc_free_client_work+0xe4/0x230\\n[  250.505598]  process_one_work+0x8ee/0x13b0\\n...\\n[   22.039056] Allocated by task 244:\\n[   22.039390]  kasan_save_stack+0x22/0x50\\n[   22.039758]  kasan_set_track+0x25/0x30\\n[   22.040109]  __kasan_slab_alloc+0x59/0x70\\n[   22.040487]  kmem_cache_alloc_lru+0xf0/0x240\\n[   22.040889]  __d_alloc+0x31/0x8e0\\n[   22.041207]  d_alloc+0x44/0x1f0\\n[   22.041514]  __rpc_lookup_create_exclusive+0x11c/0x140\\n[   22.041987]  rpc_mkdir_populate.constprop.0+0x5f/0x110\\n[   22.042459]  rpc_create_client_dir+0x34/0x150\\n[   22.042874]  rpc_setup_pipedir_sb+0x102/0x1c0\\n[   22.043284]  rpc_client_register+0x136/0x4e0\\n[   22.043689]  rpc_new_client+0x911/0x1020\\n[   22.044057]  rpc_create_xprt+0xcb/0x370\\n[   22.044417]  rpc_create+0x36b/0x6c0\\n...\\n[   22.049524] Freed by task 0:\\n[   22.049803]  kasan_save_stack+0x22/0x50\\n[   22.050165]  kasan_set_track+0x25/0x30\\n[   22.050520]  kasan_save_free_info+0x2b/0x50\\n[   22.050921]  __kasan_slab_free+0x10e/0x1a0\\n[   22.051306]  kmem_cache_free+0xa5/0x390\\n[   22.051667]  rcu_core+0x62c/0x1930\\n[   22.051995]  __do_softirq+0x165/0x52a\\n[   22.052347]\\n[   22.052503] Last potentially related work creation:\\n[   22.052952]  kasan_save_stack+0x22/0x50\\n[   22.053313]  __kasan_record_aux_stack+0x8e/0xa0\\n[   22.053739]  __call_rcu_common.constprop.0+0x6b/0x8b0\\n[   22.054209]  dentry_free+0xb2/0x140\\n[   22.054540]  __dentry_kill+0x3be/0x540\\n[   22.054900]  shrink_dentry_list+0x199/0x510\\n[   22.055293]  shrink_dcache_parent+0x190/0x240\\n[   22.055703]  do_one_tree+0x11/0x40\\n[   22.056028]  shrink_dcache_for_umount+0x61/0x140\\n[   22.056461]  generic_shutdown_super+0x70/0x590\\n[   22.056879]  kill_anon_super+0x3a/0x60\\n[   22.057234]  rpc_kill_sb+0x121/0x200\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: SUNRPC: el cliente RPC limpi\u00f3 los pipefs dentries liberados. La limpieza de pipefs dentries del cliente RPC est\u00e1 en la cola de trabajo separada rpc_remove_pipedir(), que se encarga del bloqueo del superbloque de pipefs. En algunos escenarios especiales, cuando el kernel libera el pipefs sb del cliente actual e inmediatamente asigna un nuevo pipefs sb, la funci\u00f3n rpc_remove_pipedir juzgar\u00eda mal la existencia de pipefs sb que no es el que sol\u00eda contener. Como resultado, rpc_remove_pipedir limpiar\u00eda las dentr\u00edas de pipefs liberadas. Para solucionar este problema, rpc_remove_pipedir debe verificar si el pipefs sb actual es consistente con el pipefs sb original. KASAN puede detectar este error: ============================================ =============== [250.497700] BUG: KASAN: slab-use-after-free en dget_parent+0x195/0x200 [250.498315] Lectura de tama\u00f1o 4 en la direcci\u00f3n ffff88800a2ab804 por tarea kworker/0 :18/106503 [250.500549] Cola de trabajo: eventos rpc_free_client_work [250.501001] Seguimiento de llamadas: [250.502880] kasan_report+0xb6/0xf0 [250.503209]? dget_parent+0x195/0x200 [ 250.503561] dget_parent+0x195/0x200 [ 250.503897] ? __pfx_rpc_clntdir_depopulate+0x10/0x10 [ 250.504384] rpc_rmdir_depopulate+0x1b/0x90 [ 250.504781] rpc_remove_client_dir+0xf5/0x150 [ 250.505195] /0x230 [ 250.505598] Process_one_work+0x8ee/0x13b0 ... [ 22.039056] Asignado por la tarea 244: [ 22.039390 ] kasan_save_stack+0x22/0x50 [ 22.039758] kasan_set_track+0x25/0x30 [ 22.040109] __kasan_slab_alloc+0x59/0x70 [ 22.040487] kmem_cache_alloc_lru+0xf0/0x240 [ 22.0408 89] __d_alloc+0x31/0x8e0 [ 22.041207] d_alloc+0x44/0x1f0 [ 22.041514] __rpc_lookup_create_exclusive +0x11c/0x140 [ 22.041987] rpc_mkdir_populate.constprop.0+0x5f/0x110 [ 22.042459] rpc_create_client_dir+0x34/0x150 [ 22.042874] rpc_setup_pipedir_sb+0x102/0x1c0 [ 22.043284] rpc_client_register+0x136/0x4e0 [ 22.043689] rpc_new_client+0x911/0x1020 [ 22.044057 ] rpc_create_xprt+0xcb/0x370 [ 22.044417] rpc_create+0x36b/0x6c0 ... [ 22.049524] Liberado por la tarea 0: [ 22.049803] kasan_save_stack+0x22/0x50 [ 22.050165] 25/0x30 [ 22.050520] kasan_save_free_info+0x2b/0x50 [ 22.050921] __kasan_slab_free+0x10e/0x1a0 [ 22.051306] kmem_cache_free+0xa5/0x390 [ 22.051667] rcu_core+0x62c/0x1930 [ 22.051995] __do_softirq+0x165/0x52a [ 22.052347] [ 22.052503] \u00daltima creaci\u00f3n de trabajo potencialmente relacionado: [ 22.052952] kasan_save_stack+0x22/ 0x50 [ 22.053313] __kasan_record_aux_stack+0x8e/0xa0 [ 22.053739] __call_rcu_common.constprop.0+0x6b/0x8b0 [ 22.054209] dentry_free+0xb2/0x140 [ __dentry_kill+ 0x3be/0x540 [22.054900] Shrink_dentry_list+0x199/0x510 [22.055293] Shrink_dcache_parent+ 0x190/0x240 [ 22.055703] do_one_tree+0x11/0x40 [ 22.056028] shrink_dcache_for_umount+0x61/0x140 [ 22.056461] generic_shutdown_super+0x70/0x590 [ 22.056879] 3a/0x60 [22.057234] rpc_kill_sb+0x121/0x200\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/sunrpc/clnt.h\",\"net/sunrpc/clnt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0157d021d23a087eecfa830502f81cfe843f0d16\",\"lessThan\":\"17866066b8ac1cc38fb449670bc15dc9fee4b40a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0157d021d23a087eecfa830502f81cfe843f0d16\",\"lessThan\":\"7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0157d021d23a087eecfa830502f81cfe843f0d16\",\"lessThan\":\"dedf2a0eb9448ae73b270743e6ea9b108189df46\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0157d021d23a087eecfa830502f81cfe843f0d16\",\"lessThan\":\"194454afa6aa9d6ed74f0c57127bc8beb27c20df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0157d021d23a087eecfa830502f81cfe843f0d16\",\"lessThan\":\"7749fd2dbef72a52b5c9ffdbf877691950ed4680\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0157d021d23a087eecfa830502f81cfe843f0d16\",\"lessThan\":\"1cdb52ffd6600a37bd355d8dce58ecd03e55e618\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0157d021d23a087eecfa830502f81cfe843f0d16\",\"lessThan\":\"cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0157d021d23a087eecfa830502f81cfe843f0d16\",\"lessThan\":\"bfca5fb4e97c46503ddfc582335917b0cc228264\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/sunrpc/clnt.h\",\"net/sunrpc/clnt.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.318\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.280\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.202\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.140\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.64\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5.13\",\"lessThanOrEqual\":\"6.5.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.3\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-17T17:36:49.719946Z\",\"id\":\"CVE-2023-52803\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.4\",\"versionEndExcluding\":\"4.19.318\",\"matchCriteriaId\":\"09D1ABBF-1B49-4F11-8DB5-A31F71AE983E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.280\",\"matchCriteriaId\":\"625DBFAB-C3D0-4309-A27F-12D6428FB38F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.202\",\"matchCriteriaId\":\"39D508B4-58C7-40C2-BE05-44E41110EB98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.140\",\"matchCriteriaId\":\"15D6C23C-78A3-40D2-B76B-4F1D9C2D95C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.64\",\"matchCriteriaId\":\"8D7C884A-CAA2-4EA2-9FEB-5CE776D7B05F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.5.13\",\"matchCriteriaId\":\"674C4F82-C336-4B49-BF64-1DE422E889C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.3\",\"matchCriteriaId\":\"B58252FA-A49C-411F-9B28-DC5FE44BC5A0\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/17866066b8ac1cc38fb449670bc15dc9fee4b40a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/194454afa6aa9d6ed74f0c57127bc8beb27c20df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1cdb52ffd6600a37bd355d8dce58ecd03e55e618\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7749fd2dbef72a52b5c9ffdbf877691950ed4680\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bfca5fb4e97c46503ddfc582335917b0cc228264\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dedf2a0eb9448ae73b270743e6ea9b108189df46\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/17866066b8ac1cc38fb449670bc15dc9fee4b40a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/194454afa6aa9d6ed74f0c57127bc8beb27c20df\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1cdb52ffd6600a37bd355d8dce58ecd03e55e618\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7749fd2dbef72a52b5c9ffdbf877691950ed4680\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bfca5fb4e97c46503ddfc582335917b0cc228264\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dedf2a0eb9448ae73b270743e6ea9b108189df46\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T10:56:26+00:00",
      "cve": "CVE-2023-52803",
      "id": "CVE-2023-52803",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "429",
      "product_status:known_affected": "150",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52803.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-05T00:49:52Z",
      "cve": "CVE-2023-52803",
      "id": "CVE-2023-52803",
      "initial_release_date": "2024-05-23T02:56:52Z",
      "product_status:known_affected": "428",
      "product_status:known_not_affected": "30",
      "product_status:recommended": "770",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-52803",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-52803.json",
      "version": "106"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/17866066b8ac1cc38fb449670bc15dc9fee4b40a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/dedf2a0eb9448ae73b270743e6ea9b108189df46\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/194454afa6aa9d6ed74f0c57127bc8beb27c20df\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7749fd2dbef72a52b5c9ffdbf877691950ed4680\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1cdb52ffd6600a37bd355d8dce58ecd03e55e618\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bfca5fb4e97c46503ddfc582335917b0cc228264\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:11:35.893Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52803\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-17T17:36:49.719946Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-17T17:36:50.673Z\"}}], \"cna\": {\"title\": \"SUNRPC: Fix RPC client cleaned up the freed pipefs dentries\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0157d021d23a087eecfa830502f81cfe843f0d16\", \"lessThan\": \"17866066b8ac1cc38fb449670bc15dc9fee4b40a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0157d021d23a087eecfa830502f81cfe843f0d16\", \"lessThan\": \"7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0157d021d23a087eecfa830502f81cfe843f0d16\", \"lessThan\": \"dedf2a0eb9448ae73b270743e6ea9b108189df46\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0157d021d23a087eecfa830502f81cfe843f0d16\", \"lessThan\": \"194454afa6aa9d6ed74f0c57127bc8beb27c20df\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0157d021d23a087eecfa830502f81cfe843f0d16\", \"lessThan\": \"7749fd2dbef72a52b5c9ffdbf877691950ed4680\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0157d021d23a087eecfa830502f81cfe843f0d16\", \"lessThan\": \"1cdb52ffd6600a37bd355d8dce58ecd03e55e618\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0157d021d23a087eecfa830502f81cfe843f0d16\", \"lessThan\": \"cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0157d021d23a087eecfa830502f81cfe843f0d16\", \"lessThan\": \"bfca5fb4e97c46503ddfc582335917b0cc228264\", \"versionType\": \"git\"}], \"programFiles\": [\"include/linux/sunrpc/clnt.h\", \"net/sunrpc/clnt.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.318\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.280\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.202\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.140\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.64\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.5.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.5.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/linux/sunrpc/clnt.h\", \"net/sunrpc/clnt.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/17866066b8ac1cc38fb449670bc15dc9fee4b40a\"}, {\"url\": \"https://git.kernel.org/stable/c/7d61d1da2ed1f682c41cae0c8d4719cdaccee5c5\"}, {\"url\": \"https://git.kernel.org/stable/c/dedf2a0eb9448ae73b270743e6ea9b108189df46\"}, {\"url\": \"https://git.kernel.org/stable/c/194454afa6aa9d6ed74f0c57127bc8beb27c20df\"}, {\"url\": \"https://git.kernel.org/stable/c/7749fd2dbef72a52b5c9ffdbf877691950ed4680\"}, {\"url\": \"https://git.kernel.org/stable/c/1cdb52ffd6600a37bd355d8dce58ecd03e55e618\"}, {\"url\": \"https://git.kernel.org/stable/c/cc2e7ebbeb1d0601f7f3c8d93b78fcc03a95e44a\"}, {\"url\": \"https://git.kernel.org/stable/c/bfca5fb4e97c46503ddfc582335917b0cc228264\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nSUNRPC: Fix RPC client cleaned up the freed pipefs dentries\\n\\nRPC client pipefs dentries cleanup is in separated rpc_remove_pipedir()\\nworkqueue,which takes care about pipefs superblock locking.\\nIn some special scenarios, when kernel frees the pipefs sb of the\\ncurrent client and immediately alloctes a new pipefs sb,\\nrpc_remove_pipedir function would misjudge the existence of pipefs\\nsb which is not the one it used to hold. As a result,\\nthe rpc_remove_pipedir would clean the released freed pipefs dentries.\\n\\nTo fix this issue, rpc_remove_pipedir should check whether the\\ncurrent pipefs sb is consistent with the original pipefs sb.\\n\\nThis error can be catched by KASAN:\\n=========================================================\\n[  250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200\\n[  250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503\\n[  250.500549] Workqueue: events rpc_free_client_work\\n[  250.501001] Call Trace:\\n[  250.502880]  kasan_report+0xb6/0xf0\\n[  250.503209]  ? dget_parent+0x195/0x200\\n[  250.503561]  dget_parent+0x195/0x200\\n[  250.503897]  ? __pfx_rpc_clntdir_depopulate+0x10/0x10\\n[  250.504384]  rpc_rmdir_depopulate+0x1b/0x90\\n[  250.504781]  rpc_remove_client_dir+0xf5/0x150\\n[  250.505195]  rpc_free_client_work+0xe4/0x230\\n[  250.505598]  process_one_work+0x8ee/0x13b0\\n...\\n[   22.039056] Allocated by task 244:\\n[   22.039390]  kasan_save_stack+0x22/0x50\\n[   22.039758]  kasan_set_track+0x25/0x30\\n[   22.040109]  __kasan_slab_alloc+0x59/0x70\\n[   22.040487]  kmem_cache_alloc_lru+0xf0/0x240\\n[   22.040889]  __d_alloc+0x31/0x8e0\\n[   22.041207]  d_alloc+0x44/0x1f0\\n[   22.041514]  __rpc_lookup_create_exclusive+0x11c/0x140\\n[   22.041987]  rpc_mkdir_populate.constprop.0+0x5f/0x110\\n[   22.042459]  rpc_create_client_dir+0x34/0x150\\n[   22.042874]  rpc_setup_pipedir_sb+0x102/0x1c0\\n[   22.043284]  rpc_client_register+0x136/0x4e0\\n[   22.043689]  rpc_new_client+0x911/0x1020\\n[   22.044057]  rpc_create_xprt+0xcb/0x370\\n[   22.044417]  rpc_create+0x36b/0x6c0\\n...\\n[   22.049524] Freed by task 0:\\n[   22.049803]  kasan_save_stack+0x22/0x50\\n[   22.050165]  kasan_set_track+0x25/0x30\\n[   22.050520]  kasan_save_free_info+0x2b/0x50\\n[   22.050921]  __kasan_slab_free+0x10e/0x1a0\\n[   22.051306]  kmem_cache_free+0xa5/0x390\\n[   22.051667]  rcu_core+0x62c/0x1930\\n[   22.051995]  __do_softirq+0x165/0x52a\\n[   22.052347]\\n[   22.052503] Last potentially related work creation:\\n[   22.052952]  kasan_save_stack+0x22/0x50\\n[   22.053313]  __kasan_record_aux_stack+0x8e/0xa0\\n[   22.053739]  __call_rcu_common.constprop.0+0x6b/0x8b0\\n[   22.054209]  dentry_free+0xb2/0x140\\n[   22.054540]  __dentry_kill+0x3be/0x540\\n[   22.054900]  shrink_dentry_list+0x199/0x510\\n[   22.055293]  shrink_dcache_parent+0x190/0x240\\n[   22.055703]  do_one_tree+0x11/0x40\\n[   22.056028]  shrink_dcache_for_umount+0x61/0x140\\n[   22.056461]  generic_shutdown_super+0x70/0x590\\n[   22.056879]  kill_anon_super+0x3a/0x60\\n[   22.057234]  rpc_kill_sb+0x121/0x200\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T08:26:15.211Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52803\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T08:26:15.211Z\", \"dateReserved\": \"2024-05-21T15:19:24.247Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T15:31:15.063Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.