fkie_nvd - fkie_cve-2023-54085

fkie_cve-2023-54085

Vulnerability from fkie_nvd

Published

2025-12-24 13:16

Modified

2025-12-24 13:16

Severity ?

Summary

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix NULL pointer dereference on fastopen early fallback In case of early fallback to TCP, subflow_syn_recv_sock() deletes the subflow context before returning the newly allocated sock to the caller. The fastopen path does not cope with the above unconditionally dereferencing the subflow context.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/95135835519b0ab931c39908b2c99e9fb3c9068b
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/c0ff6f6da66a7791a32c0234388b1bdc00244917

Impacted products

	Vendor	Product	Version

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix NULL pointer dereference on fastopen early fallback\n\nIn case of early fallback to TCP, subflow_syn_recv_sock() deletes\nthe subflow context before returning the newly allocated sock to\nthe caller.\n\nThe fastopen path does not cope with the above unconditionally\ndereferencing the subflow context."
    }
  ],
  "id": "CVE-2023-54085",
  "lastModified": "2025-12-24T13:16:10.357",
  "metrics": {},
  "published": "2025-12-24T13:16:10.357",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/95135835519b0ab931c39908b2c99e9fb3c9068b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c0ff6f6da66a7791a32c0234388b1bdc00244917"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2023-54085 (GCVE-0-2023-54085)

Vulnerability from cvelistv5

Published

2025-12-24 13:06

Modified

2025-12-24 13:06

Severity ?

Summary

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix NULL pointer dereference on fastopen early fallback In case of early fallback to TCP, subflow_syn_recv_sock() deletes the subflow context before returning the newly allocated sock to the caller. The fastopen path does not cope with the above unconditionally dereferencing the subflow context.

References

URL

Tags

	https://git.kernel.org/stable/c/95135835519b0ab931c39908b2c99e9fb3c9068b
	https://git.kernel.org/stable/c/c0ff6f6da66a7791a32c0234388b1bdc00244917

Impacted products

Vendor

Product

Version

Version: 36b122baf6a8bd46b4a591f12f4ed17b22257408
Version: 36b122baf6a8bd46b4a591f12f4ed17b22257408

Version: 6.2

Show details on NVD website

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/fastopen.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "95135835519b0ab931c39908b2c99e9fb3c9068b",
              "status": "affected",
              "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
              "versionType": "git"
            },
            {
              "lessThan": "c0ff6f6da66a7791a32c0234388b1bdc00244917",
              "status": "affected",
              "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/fastopen.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.12",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix NULL pointer dereference on fastopen early fallback\n\nIn case of early fallback to TCP, subflow_syn_recv_sock() deletes\nthe subflow context before returning the newly allocated sock to\nthe caller.\n\nThe fastopen path does not cope with the above unconditionally\ndereferencing the subflow context."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-24T13:06:16.161Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/95135835519b0ab931c39908b2c99e9fb3c9068b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0ff6f6da66a7791a32c0234388b1bdc00244917"
        }
      ],
      "title": "mptcp: fix NULL pointer dereference on fastopen early fallback",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54085",
    "datePublished": "2025-12-24T13:06:16.161Z",
    "dateReserved": "2025-12-24T13:02:52.515Z",
    "dateUpdated": "2025-12-24T13:06:16.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.