CVE-2023-52895 (GCVE-0-2023-52895)

Vulnerability from cvelistv5 – Published: 2024-08-21 06:10 – Updated: 2025-05-04 07:45
VLAI?
Summary
In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: don't reissue in case of poll race on multishot request A previous commit fixed a poll race that can occur, but it's only applicable for multishot requests. For a multishot request, we can safely ignore a spurious wakeup, as we never leave the waitqueue to begin with. A blunt reissue of a multishot armed request can cause us to leak a buffer, if they are ring provided. While this seems like a bug in itself, it's not really defined behavior to reissue a multishot request directly. It's less efficient to do so as well, and not required to rearm anything like it is for singleshot poll requests.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: c06015ebc4367be38904b88582e13cc079672075 , < 36fc7317cdb16cfeae0f879916995037bb615ac4 (git)
Affected: 6e5aedb9324aab1c14a23fae3d8eeb64a679c20e , < 8caa03f10bf92cb8657408a6ece6a8a73f96ce13 (git)
Create a notification for this product.
    Linux Linux Affected: 6.1.7 , < 6.1.8 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52895",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:03:46.864583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:13.444Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/poll.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "36fc7317cdb16cfeae0f879916995037bb615ac4",
              "status": "affected",
              "version": "c06015ebc4367be38904b88582e13cc079672075",
              "versionType": "git"
            },
            {
              "lessThan": "8caa03f10bf92cb8657408a6ece6a8a73f96ce13",
              "status": "affected",
              "version": "6e5aedb9324aab1c14a23fae3d8eeb64a679c20e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/poll.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.1.8",
              "status": "affected",
              "version": "6.1.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.8",
                  "versionStartIncluding": "6.1.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: don\u0027t reissue in case of poll race on multishot request\n\nA previous commit fixed a poll race that can occur, but it\u0027s only\napplicable for multishot requests. For a multishot request, we can safely\nignore a spurious wakeup, as we never leave the waitqueue to begin with.\n\nA blunt reissue of a multishot armed request can cause us to leak a\nbuffer, if they are ring provided. While this seems like a bug in itself,\nit\u0027s not really defined behavior to reissue a multishot request directly.\nIt\u0027s less efficient to do so as well, and not required to rearm anything\nlike it is for singleshot poll requests."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:45:28.206Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/36fc7317cdb16cfeae0f879916995037bb615ac4"
        },
        {
          "url": "https://git.kernel.org/stable/c/8caa03f10bf92cb8657408a6ece6a8a73f96ce13"
        }
      ],
      "title": "io_uring/poll: don\u0027t reissue in case of poll race on multishot request",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52895",
    "datePublished": "2024-08-21T06:10:35.179Z",
    "dateReserved": "2024-08-21T06:07:11.013Z",
    "dateUpdated": "2025-05-04T07:45:28.206Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.1.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6E5E3E6D-B23E-4B23-9819-3DEB8963E4E3\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nio_uring/poll: don\u0027t reissue in case of poll race on multishot request\\n\\nA previous commit fixed a poll race that can occur, but it\u0027s only\\napplicable for multishot requests. For a multishot request, we can safely\\nignore a spurious wakeup, as we never leave the waitqueue to begin with.\\n\\nA blunt reissue of a multishot armed request can cause us to leak a\\nbuffer, if they are ring provided. While this seems like a bug in itself,\\nit\u0027s not really defined behavior to reissue a multishot request directly.\\nIt\u0027s less efficient to do so as well, and not required to rearm anything\\nlike it is for singleshot poll requests.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: io_uring/poll: no volver a emitir en caso de ejecuci\\u00f3n de sondeo en solicitud de m\\u00faltiples disparos. Una confirmaci\\u00f3n anterior solucion\\u00f3 una ejecuci\\u00f3n de sondeo que puede ocurrir, pero solo se aplica a solicitudes de m\\u00faltiples disparos. Para una solicitud de disparo m\\u00faltiple, podemos ignorar con seguridad una activaci\\u00f3n espuria, ya que, para empezar, nunca salimos de la cola de espera. Una reemisi\\u00f3n contundente de una solicitud de armado de m\\u00faltiples disparos puede hacer que perdamos un b\\u00fafer, si se proporciona en anillo. Si bien esto parece un error en s\\u00ed mismo, en realidad no es un comportamiento definido volver a emitir una solicitud multidisparo directamente. Tambi\\u00e9n es menos eficiente hacerlo y no es necesario rearmar nada como lo es para solicitudes de sondeo de un solo disparo.\"}]",
      "id": "CVE-2023-52895",
      "lastModified": "2024-09-11T16:31:31.597",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-08-21T07:15:06.007",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/36fc7317cdb16cfeae0f879916995037bb615ac4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8caa03f10bf92cb8657408a6ece6a8a73f96ce13\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-401\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52895\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-21T07:15:06.007\",\"lastModified\":\"2024-09-11T16:31:31.597\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nio_uring/poll: don\u0027t reissue in case of poll race on multishot request\\n\\nA previous commit fixed a poll race that can occur, but it\u0027s only\\napplicable for multishot requests. For a multishot request, we can safely\\nignore a spurious wakeup, as we never leave the waitqueue to begin with.\\n\\nA blunt reissue of a multishot armed request can cause us to leak a\\nbuffer, if they are ring provided. While this seems like a bug in itself,\\nit\u0027s not really defined behavior to reissue a multishot request directly.\\nIt\u0027s less efficient to do so as well, and not required to rearm anything\\nlike it is for singleshot poll requests.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: io_uring/poll: no volver a emitir en caso de ejecuci\u00f3n de sondeo en solicitud de m\u00faltiples disparos. Una confirmaci\u00f3n anterior solucion\u00f3 una ejecuci\u00f3n de sondeo que puede ocurrir, pero solo se aplica a solicitudes de m\u00faltiples disparos. Para una solicitud de disparo m\u00faltiple, podemos ignorar con seguridad una activaci\u00f3n espuria, ya que, para empezar, nunca salimos de la cola de espera. Una reemisi\u00f3n contundente de una solicitud de armado de m\u00faltiples disparos puede hacer que perdamos un b\u00fafer, si se proporciona en anillo. Si bien esto parece un error en s\u00ed mismo, en realidad no es un comportamiento definido volver a emitir una solicitud multidisparo directamente. Tambi\u00e9n es menos eficiente hacerlo y no es necesario rearmar nada como lo es para solicitudes de sondeo de un solo disparo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E5E3E6D-B23E-4B23-9819-3DEB8963E4E3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/36fc7317cdb16cfeae0f879916995037bb615ac4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8caa03f10bf92cb8657408a6ece6a8a73f96ce13\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52895\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:03:46.864583Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:18.025Z\"}}], \"cna\": {\"title\": \"io_uring/poll: don\u0027t reissue in case of poll race on multishot request\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c06015ebc436\", \"lessThan\": \"36fc7317cdb1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6e5aedb9324a\", \"lessThan\": \"8caa03f10bf9\", \"versionType\": \"git\"}], \"programFiles\": [\"io_uring/poll.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.1.7\", \"lessThan\": \"6.1.8\", \"versionType\": \"custom\"}], \"programFiles\": [\"io_uring/poll.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/36fc7317cdb16cfeae0f879916995037bb615ac4\"}, {\"url\": \"https://git.kernel.org/stable/c/8caa03f10bf92cb8657408a6ece6a8a73f96ce13\"}], \"x_generator\": {\"engine\": \"bippy-c9c4e1df01b2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nio_uring/poll: don\u0027t reissue in case of poll race on multishot request\\n\\nA previous commit fixed a poll race that can occur, but it\u0027s only\\napplicable for multishot requests. For a multishot request, we can safely\\nignore a spurious wakeup, as we never leave the waitqueue to begin with.\\n\\nA blunt reissue of a multishot armed request can cause us to leak a\\nbuffer, if they are ring provided. While this seems like a bug in itself,\\nit\u0027s not really defined behavior to reissue a multishot request directly.\\nIt\u0027s less efficient to do so as well, and not required to rearm anything\\nlike it is for singleshot poll requests.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-08-21T06:10:35.179Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52895\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-12T17:33:13.444Z\", \"dateReserved\": \"2024-08-21T06:07:11.013Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-21T06:10:35.179Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.