CVE-2023-52636 libceph: just wait for more data to be available on the socket
A logic error in the Linux kernel's Ceph client can cause a denial of service by misinterpreting network data during sparse reads.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52636?
CVE-2023-52636 is a high-severity denial of service vulnerability in Linux kernel, published on 2 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
libceph: just wait for more data to be available on the socket
A short read may occur while reading the message footer from the socket. Later, when the socket is ready for another read, the messenger invokes all read_partial_*() handlers, including read_partial_sparse_msg_data(). The expectation is that read_partial_sparse_msg_data() would bail, allowing the messenger to invoke read_partial() for the footer and pick up where it left off.
However read_partial_sparse_msg_data() violates that and ends up calling into the state machine in the OSD client. The sparse-read state machine assumes that it's a new op and interprets some piece of the footer as the sparse-read header and returns bogus extents/data length, etc.
To determine whether read_partial_sparse_msg_data() should bail, let's reuse cursor->total_resid. Because once it reaches to zero that means all the extents and data have been successfully received in last read, else it could break out when partially reading any of the extents and data. And then osd_sparse_read() could continue where it left off.
[ idryomov: changelog ]
Which versions are affected by CVE-2023-52636?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-52636?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-52636 being exploited?
There is no known exploitation of CVE-2023-52636 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-52636, DEBIAN-CVE-2023-52636, GHSA-fqg2-664v-fx4j, UBUNTU-CVE-2023-52636.