ghsa-8r48-cm72-rr67
Vulnerability from github
Published
2025-09-16 18:31
Modified
2025-09-16 18:31
Details

In the Linux kernel, the following vulnerability has been resolved:

rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails

If getting an ID or setting up a work queue in rbd_dev_create() fails, use-after-free on rbd_dev->rbd_client, rbd_dev->spec and rbd_dev->opts is triggered in do_rbd_add(). The root cause is that the ownership of these structures is transfered to rbd_dev prematurely and they all end up getting freed when rbd_dev_create() calls rbd_dev_free() prior to returning to do_rbd_add().

Found by Linux Verification Center (linuxtesting.org) with SVACE, an incomplete patch submitted by Natalia Petrova n.petrova@fintech.ru.

Show details on source website

To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-53307"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-16T17:15:36Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails\n\nIf getting an ID or setting up a work queue in rbd_dev_create() fails,\nuse-after-free on rbd_dev-\u003erbd_client, rbd_dev-\u003espec and rbd_dev-\u003eopts\nis triggered in do_rbd_add().  The root cause is that the ownership of\nthese structures is transfered to rbd_dev prematurely and they all end\nup getting freed when rbd_dev_create() calls rbd_dev_free() prior to\nreturning to do_rbd_add().\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE, an\nincomplete patch submitted by Natalia Petrova \u003cn.petrova@fintech.ru\u003e.",
  "id": "GHSA-8r48-cm72-rr67",
  "modified": "2025-09-16T18:31:26Z",
  "published": "2025-09-16T18:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53307"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/71da2a151ed1adb0aea4252b16d81b53012e7afd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9787b328c42c13c4f31e7d5042c4e877e9344068"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a73783e4e0c4d1507794da211eeca75498544dff"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ae16346078b1189aee934afd872d9f3d0a682c33"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cc8c0dd2984503ed09efa37bcafcef3d3da104e8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e3cbb4d60764295992c95344f2d779439e8b34ce"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f7c4d9b133c7a04ca619355574e96b6abf209fba"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/faa7b683e436664fff5648426950718277831348"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.