CVE-2023-54201 (GCVE-0-2023-54201)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:09 – Updated: 2026-08-05 09:17
VLAI
Title
RDMA/efa: Fix wrong resources deallocation order
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix wrong resources deallocation order When trying to destroy QP or CQ, we first decrease the refcount and potentially free memory regions allocated for the object and then request the device to destroy the object. If the device fails, the object isn't fully destroyed so the user/IB core can try to destroy the object again which will lead to underflow when trying to decrease an already zeroed refcount. Deallocate resources in reverse order of allocating them to safely free them.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: ff6629f88c529b07d9704c656c64dae76910e3e9 , < cf38960386f3cc4abf395e556af915e4babcafd2 (git)
Affected: ff6629f88c529b07d9704c656c64dae76910e3e9 , < e79db2f51a564fd4daa3e508b987df5e81c34b20 (git)
Affected: ff6629f88c529b07d9704c656c64dae76910e3e9 , < 24f9884971f9b34915b67baacf7350a3f6f19ea4 (git)
Affected: ff6629f88c529b07d9704c656c64dae76910e3e9 , < dc202c57e9a1423aed528e4b8dc949509cd32191 (git)
Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 6.1.53 , ≤ 6.1.* (semver)
Unaffected: 6.4.16 , ≤ 6.4.* (semver)
Unaffected: 6.5.3 , ≤ 6.5.* (semver)
Unaffected: 6.6 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/efa/efa_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cf38960386f3cc4abf395e556af915e4babcafd2",
              "status": "affected",
              "version": "ff6629f88c529b07d9704c656c64dae76910e3e9",
              "versionType": "git"
            },
            {
              "lessThan": "e79db2f51a564fd4daa3e508b987df5e81c34b20",
              "status": "affected",
              "version": "ff6629f88c529b07d9704c656c64dae76910e3e9",
              "versionType": "git"
            },
            {
              "lessThan": "24f9884971f9b34915b67baacf7350a3f6f19ea4",
              "status": "affected",
              "version": "ff6629f88c529b07d9704c656c64dae76910e3e9",
              "versionType": "git"
            },
            {
              "lessThan": "dc202c57e9a1423aed528e4b8dc949509cd32191",
              "status": "affected",
              "version": "ff6629f88c529b07d9704c656c64dae76910e3e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/efa/efa_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.53",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.16",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.3",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/efa: Fix wrong resources deallocation order\n\nWhen trying to destroy QP or CQ, we first decrease the refcount and\npotentially free memory regions allocated for the object and then\nrequest the device to destroy the object. If the device fails, the\nobject isn\u0027t fully destroyed so the user/IB core can try to destroy the\nobject again which will lead to underflow when trying to decrease an\nalready zeroed refcount.\n\nDeallocate resources in reverse order of allocating them to safely free\nthem."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires opening the local RDMA character device /dev/infiniband/uverbs0 and issuing uverbs ioctl/write commands (create QP, destroy QP); there is no remote or adjacent-network entry into efa_destroy_qp().\nAC:L - The attacker fully controls the double-destroy sequence, and once the EFA admin queue latches EFA_AQ_STATE_RUNNING_BIT off, every destroy_qp fails deterministically so the stale-pointer path is hit on every retry \u2014 including automatically during fd-close cleanup, requiring no race or special memory layout.\nPR:L - Any unprivileged local user who can open the uverbs device (installed mode 0666 by rdma-core udev rules, since EFA exists to serve unprivileged MPI/libfabric jobs) can allocate a ucontext, PD, CQ and QP and then destroy it; no capability is checked on the EFA QP create/destroy path.\nUI:N - The attacker performs every step from their own process \u2014 creating and destroying the QP \u2014 with no action needed from any other user or administrator.\nS:U - The use-after-free corrupts kernel slab memory within the same host kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The second rdma_user_mmap_entry_remove() dereferences a kfree\u0027d struct efa_user_mmap_entry, reading entry-\u003eucontext and start_pgoff/npages from reclaimed slab memory; with heap grooming this UAF gives an attacker-controlled read primitive into kernel memory.\nI:H - The stale entry is written to (driver_removed = true), its refcount is decremented on freed memory, and efa_mmap_free() kfree()s it a second time \u2014 a double-free/arbitrary-free plus controlled xarray erasure that is a well-known route to arbitrary write and control-flow hijack.\nA:H - Even without exploitation, the refcount underflow triggers a refcount_t WARN/splat and the double free corrupts the slab allocator, reliably producing a kernel oops or panic on the affected host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:59.823Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cf38960386f3cc4abf395e556af915e4babcafd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/e79db2f51a564fd4daa3e508b987df5e81c34b20"
        },
        {
          "url": "https://git.kernel.org/stable/c/24f9884971f9b34915b67baacf7350a3f6f19ea4"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc202c57e9a1423aed528e4b8dc949509cd32191"
        }
      ],
      "title": "RDMA/efa: Fix wrong resources deallocation order",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54201",
    "datePublished": "2025-12-30T12:09:06.211Z",
    "dateReserved": "2025-12-30T12:06:44.499Z",
    "dateUpdated": "2026-08-05T09:17:59.823Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54201",
      "date": "2026-08-09",
      "epss": "0.00134",
      "percentile": "0.03272"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-54201\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-30T13:16:08.210\",\"lastModified\":\"2026-08-04T11:16:36.377\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/efa: Fix wrong resources deallocation order\\n\\nWhen trying to destroy QP or CQ, we first decrease the refcount and\\npotentially free memory regions allocated for the object and then\\nrequest the device to destroy the object. If the device fails, the\\nobject isn\u0027t fully destroyed so the user/IB core can try to destroy the\\nobject again which will lead to underflow when trying to decrease an\\nalready zeroed refcount.\\n\\nDeallocate resources in reverse order of allocating them to safely free\\nthem.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/hw/efa/efa_verbs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ff6629f88c529b07d9704c656c64dae76910e3e9\",\"lessThan\":\"cf38960386f3cc4abf395e556af915e4babcafd2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ff6629f88c529b07d9704c656c64dae76910e3e9\",\"lessThan\":\"e79db2f51a564fd4daa3e508b987df5e81c34b20\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ff6629f88c529b07d9704c656c64dae76910e3e9\",\"lessThan\":\"24f9884971f9b34915b67baacf7350a3f6f19ea4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ff6629f88c529b07d9704c656c64dae76910e3e9\",\"lessThan\":\"dc202c57e9a1423aed528e4b8dc949509cd32191\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/hw/efa/efa_verbs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.53\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.16\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5.3\",\"lessThanOrEqual\":\"6.5.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/24f9884971f9b34915b67baacf7350a3f6f19ea4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cf38960386f3cc4abf395e556af915e4babcafd2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dc202c57e9a1423aed528e4b8dc949509cd32191\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e79db2f51a564fd4daa3e508b987df5e81c34b20\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:14:52+00:00",
      "cve": "CVE-2023-54201",
      "id": "CVE-2023-54201",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "399",
      "product_status:known_affected": "38",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/efa: Fix wrong resources deallocation order",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54201.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T02:05:19Z",
      "cve": "CVE-2023-54201",
      "id": "CVE-2023-54201",
      "initial_release_date": "2025-12-31T00:28:37Z",
      "product_status:known_affected": "409",
      "product_status:known_not_affected": "156",
      "product_status:recommended": "455",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54201",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54201.json",
      "version": "35"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.