Log in Start free

Vulnerability · Published May 2, 2025 · Assigned by Linux

CVE-2023-53088mptcp: fix UaF in listener shutdown

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 89.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix UaF in listener shutdown As reported by Christoph after having refactored the passive socket initialization, the mptcp listener shutdown path is prone to an UaF issue. BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x73/0xe0 Write of size 4 at addr ffff88810cb23098 by task syz-executor731/1266 CPU: 1 PID: 1266 Comm: syz-executor731 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x6e/0x91 print_report+0x16a/0x46f kasan_report+0xad/0x130 kasan_check_range+0x14a/0x1a0 _raw_spin_lock_bh+0x73/0xe0 subflow_error_report+0x6d/0x110 sk_error_report+0x3b/0x190 tcp_disconnect+0x138c/0x1aa0 inet_child_forget+0x6f/0x2e0 inet_csk_listen_stop+0x209/0x1060 __mptcp_close_ssk+0x52d/0x610 mptcp_destroy_common+0x165/0x640 mptcp_destroy+0x13/0x80 __mptcp_destroy_sock+0xe7/0x270 __mptcp_close+0x70e/0x9b0 mptcp_close+0x2b/0x150 inet_release+0xe9/0x1f0 __sock_release+0xd2/0x280 sock_close+0x15/0x20 __fput+0x252/0xa20 task_work_run+0x169/0x250 exit_to_user_mode_prepare+0x113/0x120 syscall_exit_to_user_mode+0x1d/0x40 do_syscall_64+0x48/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc The msk grace period can legitly expire in between the last reference count dropped in mptcp_subflow_queue_clean() and the later eventual access in inet_csk_listen_stop() After the previous patch we don't need anymore special-casing msk listener socket cleanup: the mptcp worker will process each of the unaccepted msk sockets. Just drop the now unnecessary code. Please note this commit depends on the two parent ones: mptcp: refactor passive socket initialization mptcp: use the workqueue to destroy unaccepted sockets

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.25-1DEBIAN-CVE-2023-53088
Debian:13linux6.1.25-1DEBIAN-CVE-2023-53088
Debian:14linux6.1.25-1DEBIAN-CVE-2023-53088
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2023-53088
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-53088
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2023-53088
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2023-53088

Affected products (as reported)

VendorProductVersions
Linux Linux 6aeed9045071f2252ff4e98fc13d1e304f33e5b0 – before 5564be74a22a61855f8b8c100d8c4abb003bb7926aeed9045071f2252ff4e98fc13d1e304f33e5b0 – before 0f4f4cf5d32f10543deb946a37111e714579511e6aeed9045071f2252ff4e98fc13d1e304f33e5b0 – before 0a3f4f1f9c27215e4ddcd312558342e57b93e518a8a3e95c74e48c2c9b07b81fafda9122993f2e125.18.10 – before 5.19
Linux Linux 5.19

References