CVE-2023-52895 io_uring/poll: don't reissue in case of poll race on multishot request
A race condition in Linux kernel io_uring multishot poll requests can cause buffer leaks, potentially leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52895?
CVE-2023-52895 is a medium-severity memory corruption vulnerability in Linux kernel, published on 21 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
io_uring/poll: don't reissue in case of poll race on multishot request
A previous commit fixed a poll race that can occur, but it's only applicable for multishot requests. For a multishot request, we can safely ignore a spurious wakeup, as we never leave the waitqueue to begin with.
A blunt reissue of a multishot armed request can cause us to leak a buffer, if they are ring provided. While this seems like a bug in itself, it's not really defined behavior to reissue a multishot request directly. It's less efficient to do so as well, and not required to rearm anything like it is for singleshot poll requests.
Weakness: CWE-401
Which versions are affected by CVE-2023-52895?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-52895?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-52895 being exploited?
There is no known exploitation of CVE-2023-52895 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2023-52895, GHSA-7rjr-qxc3-7hh3, UBUNTU-CVE-2023-52895.