CVE-2023-53218 (GCVE-0-2023-53218)
Vulnerability from cvelistv5
Published
2025-09-15 14:21
Modified
2025-09-15 14:21
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Make it so that a waiting process can be aborted When sendmsg() creates an rxrpc call, it queues it to wait for a connection and channel to be assigned and then waits before it can start shovelling data as the encrypted DATA packet content includes a summary of the connection parameters. However, sendmsg() may get interrupted before a connection gets assigned and further sendmsg() calls will fail with EBUSY until an assignment is made. Fix this so that the call can at least be aborted without failing on EBUSY. We have to be careful here as sendmsg() mustn't be allowed to start the call timer if the call doesn't yet have a connection assigned as an oops may follow shortly thereafter.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0eb362d254814ce04848730bf32e75b8ee1a4d6c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7161cf61c64e9e9413d790f2fa2b9dada71a2249
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/876d96faacbc407daf4978d7ec95051b68f5344a
Impacted products
Vendor Product Version
Linux Linux Version: 540b1c48c37ac0ad66212004db21e1ff7e2d78be
Version: 540b1c48c37ac0ad66212004db21e1ff7e2d78be
Version: 540b1c48c37ac0ad66212004db21e1ff7e2d78be
 Create a notification for this product.
   Linux Linux Version: 4.11
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/sendmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7161cf61c64e9e9413d790f2fa2b9dada71a2249",
              "status": "affected",
              "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
              "versionType": "git"
            },
            {
              "lessThan": "876d96faacbc407daf4978d7ec95051b68f5344a",
              "status": "affected",
              "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
              "versionType": "git"
            },
            {
              "lessThan": "0eb362d254814ce04848730bf32e75b8ee1a4d6c",
              "status": "affected",
              "version": "540b1c48c37ac0ad66212004db21e1ff7e2d78be",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/sendmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.16",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.3",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Make it so that a waiting process can be aborted\n\nWhen sendmsg() creates an rxrpc call, it queues it to wait for a connection\nand channel to be assigned and then waits before it can start shovelling\ndata as the encrypted DATA packet content includes a summary of the\nconnection parameters.\n\nHowever, sendmsg() may get interrupted before a connection gets assigned\nand further sendmsg() calls will fail with EBUSY until an assignment is\nmade.\n\nFix this so that the call can at least be aborted without failing on\nEBUSY.  We have to be careful here as sendmsg() mustn\u0027t be allowed to start\nthe call timer if the call doesn\u0027t yet have a connection assigned as an\noops may follow shortly thereafter."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T14:21:45.843Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7161cf61c64e9e9413d790f2fa2b9dada71a2249"
        },
        {
          "url": "https://git.kernel.org/stable/c/876d96faacbc407daf4978d7ec95051b68f5344a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0eb362d254814ce04848730bf32e75b8ee1a4d6c"
        }
      ],
      "title": "rxrpc: Make it so that a waiting process can be aborted",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53218",
    "datePublished": "2025-09-15T14:21:45.843Z",
    "dateReserved": "2025-09-15T14:19:21.845Z",
    "dateUpdated": "2025-09-15T14:21:45.843Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53218\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-15T15:15:48.510\",\"lastModified\":\"2025-09-15T15:22:27.090\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: Make it so that a waiting process can be aborted\\n\\nWhen sendmsg() creates an rxrpc call, it queues it to wait for a connection\\nand channel to be assigned and then waits before it can start shovelling\\ndata as the encrypted DATA packet content includes a summary of the\\nconnection parameters.\\n\\nHowever, sendmsg() may get interrupted before a connection gets assigned\\nand further sendmsg() calls will fail with EBUSY until an assignment is\\nmade.\\n\\nFix this so that the call can at least be aborted without failing on\\nEBUSY.  We have to be careful here as sendmsg() mustn\u0027t be allowed to start\\nthe call timer if the call doesn\u0027t yet have a connection assigned as an\\noops may follow shortly thereafter.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0eb362d254814ce04848730bf32e75b8ee1a4d6c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7161cf61c64e9e9413d790f2fa2b9dada71a2249\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/876d96faacbc407daf4978d7ec95051b68f5344a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.