CVE-2023-53083 (GCVE-0-2023-53083)
Vulnerability from cvelistv5
Published
2025-05-02 15:55
Modified
2025-05-04 07:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfsd: don't replace page in rq_pages if it's a continuation of last page
The splice read calls nfsd_splice_actor to put the pages containing file
data into the svc_rqst->rq_pages array. It's possible however to get a
splice result that only has a partial page at the end, if (e.g.) the
filesystem hands back a short read that doesn't cover the whole page.
nfsd_splice_actor will plop the partial page into its rq_pages array and
return. Then later, when nfsd_splice_actor is called again, the
remainder of the page may end up being filled out. At this point,
nfsd_splice_actor will put the page into the array _again_ corrupting
the reply. If this is done enough times, rq_next_page will overrun the
array and corrupt the trailing fields -- the rq_respages and
rq_next_page pointers themselves.
If we've already added the page to the array in the last pass, don't add
it to the array a second time when dealing with a splice continuation.
This was originally handled properly in nfsd_splice_actor, but commit
91e23b1c3982 ("NFSD: Clean up nfsd_splice_actor()") removed the check
for it.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/vfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8235cd619db6e67f1d7d26c55f1f3e4e575c947d",
"status": "affected",
"version": "bf1cbe2f3650b4f4a8add6af933c6d7f6af1f361",
"versionType": "git"
},
{
"lessThan": "12eca509234acb6b666802edf77408bb70d7bfca",
"status": "affected",
"version": "56bc7e3821e847a6cc8027ddaba32e9a440225a5",
"versionType": "git"
},
{
"lessThan": "51ddb84baff6f09ad62b5999ece3ec172e4e3568",
"status": "affected",
"version": "91e23b1c39820bfed642119ff6b6ef9f43cf09ce",
"versionType": "git"
},
{
"lessThan": "0101067f376eb7b9afd00279270f25d5111a091d",
"status": "affected",
"version": "91e23b1c39820bfed642119ff6b6ef9f43cf09ce",
"versionType": "git"
},
{
"lessThan": "27c934dd8832dd40fd34776f916dc201e18b319b",
"status": "affected",
"version": "91e23b1c39820bfed642119ff6b6ef9f43cf09ce",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/vfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.22",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.9",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: don\u0027t replace page in rq_pages if it\u0027s a continuation of last page\n\nThe splice read calls nfsd_splice_actor to put the pages containing file\ndata into the svc_rqst-\u003erq_pages array. It\u0027s possible however to get a\nsplice result that only has a partial page at the end, if (e.g.) the\nfilesystem hands back a short read that doesn\u0027t cover the whole page.\n\nnfsd_splice_actor will plop the partial page into its rq_pages array and\nreturn. Then later, when nfsd_splice_actor is called again, the\nremainder of the page may end up being filled out. At this point,\nnfsd_splice_actor will put the page into the array _again_ corrupting\nthe reply. If this is done enough times, rq_next_page will overrun the\narray and corrupt the trailing fields -- the rq_respages and\nrq_next_page pointers themselves.\n\nIf we\u0027ve already added the page to the array in the last pass, don\u0027t add\nit to the array a second time when dealing with a splice continuation.\nThis was originally handled properly in nfsd_splice_actor, but commit\n91e23b1c3982 (\"NFSD: Clean up nfsd_splice_actor()\") removed the check\nfor it."
}
],
"providerMetadata": {
"dateUpdated": "2025-05-04T07:49:24.528Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8235cd619db6e67f1d7d26c55f1f3e4e575c947d"
},
{
"url": "https://git.kernel.org/stable/c/12eca509234acb6b666802edf77408bb70d7bfca"
},
{
"url": "https://git.kernel.org/stable/c/51ddb84baff6f09ad62b5999ece3ec172e4e3568"
},
{
"url": "https://git.kernel.org/stable/c/0101067f376eb7b9afd00279270f25d5111a091d"
},
{
"url": "https://git.kernel.org/stable/c/27c934dd8832dd40fd34776f916dc201e18b319b"
}
],
"title": "nfsd: don\u0027t replace page in rq_pages if it\u0027s a continuation of last page",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53083",
"datePublished": "2025-05-02T15:55:31.699Z",
"dateReserved": "2025-05-02T15:51:43.550Z",
"dateUpdated": "2025-05-04T07:49:24.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2023-53083\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-02T16:15:27.310\",\"lastModified\":\"2025-05-05T20:54:45.973\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: don\u0027t replace page in rq_pages if it\u0027s a continuation of last page\\n\\nThe splice read calls nfsd_splice_actor to put the pages containing file\\ndata into the svc_rqst-\u003erq_pages array. It\u0027s possible however to get a\\nsplice result that only has a partial page at the end, if (e.g.) the\\nfilesystem hands back a short read that doesn\u0027t cover the whole page.\\n\\nnfsd_splice_actor will plop the partial page into its rq_pages array and\\nreturn. Then later, when nfsd_splice_actor is called again, the\\nremainder of the page may end up being filled out. At this point,\\nnfsd_splice_actor will put the page into the array _again_ corrupting\\nthe reply. If this is done enough times, rq_next_page will overrun the\\narray and corrupt the trailing fields -- the rq_respages and\\nrq_next_page pointers themselves.\\n\\nIf we\u0027ve already added the page to the array in the last pass, don\u0027t add\\nit to the array a second time when dealing with a splice continuation.\\nThis was originally handled properly in nfsd_splice_actor, but commit\\n91e23b1c3982 (\\\"NFSD: Clean up nfsd_splice_actor()\\\") removed the check\\nfor it.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfsd: no reemplace la p\u00e1gina en rq_pages si es una continuaci\u00f3n de la \u00faltima p\u00e1gina la lectura de empalme llama a nfsd_splice_actor para poner las p\u00e1ginas que contienen datos de archivo en la matriz svc_rqst-\u0026gt;rq_pages. Sin embargo, es posible obtener un resultado de empalme que solo tenga una p\u00e1gina parcial al final, si (p. ej.) el sistema de archivos devuelve una lectura corta que no cubre toda la p\u00e1gina. nfsd_splice_actor colocar\u00e1 la p\u00e1gina parcial en su matriz rq_pages y retornar\u00e1. Luego, m\u00e1s tarde, cuando se vuelva a llamar a nfsd_splice_actor, el resto de la p\u00e1gina puede terminar llen\u00e1ndose. En este punto, nfsd_splice_actor colocar\u00e1 la p\u00e1gina en array _again_ corrompiendo la respuesta. Si esto se repite varias veces, rq_next_page saturar\u00e1 el array y corromper\u00e1 los campos finales: los punteros rq_respages y rq_next_page. Si ya a\u00f1adimos la p\u00e1gina al array en la \u00faltima pasada, no la a\u00f1adamos una segunda vez al tratar con una continuaci\u00f3n de empalme. Esto se gestionaba correctamente en nfsd_splice_actor, pero el commit 91e23b1c3982 (\\\"NFSD: Limpiar nfsd_splice_actor()\\\") elimin\u00f3 la comprobaci\u00f3n.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0101067f376eb7b9afd00279270f25d5111a091d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/12eca509234acb6b666802edf77408bb70d7bfca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/27c934dd8832dd40fd34776f916dc201e18b319b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/51ddb84baff6f09ad62b5999ece3ec172e4e3568\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8235cd619db6e67f1d7d26c55f1f3e4e575c947d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}