GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53867 (GCVE-0-2023-53867)

Vulnerability from cvelistv5 – Published: 2025-12-24 10:55 – Updated: 2026-08-05 09:16
VLAI
Title
ceph: fix potential use-after-free bug when trimming caps
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: fix potential use-after-free bug when trimming caps When trimming the caps and just after the 'session->s_cap_lock' is released in ceph_iterate_session_caps() the cap maybe removed by another thread, and when using the stale cap memory in the callbacks it will trigger use-after-free crash. We need to check the existence of the cap just after the 'ci->i_ceph_lock' being acquired. And do nothing if it's already removed.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2f2dc053404febedc9c273452d9d518fb31fde72 , < 2b2515b8095cf2149bef44383a99d5b5677f1831 (git)
Affected: 2f2dc053404febedc9c273452d9d518fb31fde72 , < 448875a73e16ba7d81dec9274ce9d33a12d092fb (git)
Affected: 2f2dc053404febedc9c273452d9d518fb31fde72 , < ae6e935618d99cdba11eab4714092e7e5f13cf7e (git)
Affected: 2f2dc053404febedc9c273452d9d518fb31fde72 , < aaf67de78807c59c35bafb5003d4fb457c764800 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.34
Unaffected: 0 , < 2.6.34 (semver)
Unaffected: 6.1.28 , ≤ 6.1.* (semver)
Unaffected: 6.2.15 , ≤ 6.2.* (semver)
Unaffected: 6.3.2 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/caps.c",
            "fs/ceph/debugfs.c",
            "fs/ceph/mds_client.c",
            "fs/ceph/mds_client.h",
            "fs/ceph/super.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2b2515b8095cf2149bef44383a99d5b5677f1831",
              "status": "affected",
              "version": "2f2dc053404febedc9c273452d9d518fb31fde72",
              "versionType": "git"
            },
            {
              "lessThan": "448875a73e16ba7d81dec9274ce9d33a12d092fb",
              "status": "affected",
              "version": "2f2dc053404febedc9c273452d9d518fb31fde72",
              "versionType": "git"
            },
            {
              "lessThan": "ae6e935618d99cdba11eab4714092e7e5f13cf7e",
              "status": "affected",
              "version": "2f2dc053404febedc9c273452d9d518fb31fde72",
              "versionType": "git"
            },
            {
              "lessThan": "aaf67de78807c59c35bafb5003d4fb457c764800",
              "status": "affected",
              "version": "2f2dc053404febedc9c273452d9d518fb31fde72",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/caps.c",
            "fs/ceph/debugfs.c",
            "fs/ceph/mds_client.c",
            "fs/ceph/mds_client.h",
            "fs/ceph/super.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.28",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.15",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.2",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix potential use-after-free bug when trimming caps\n\nWhen trimming the caps and just after the \u0027session-\u003es_cap_lock\u0027 is\nreleased in ceph_iterate_session_caps() the cap maybe removed by\nanother thread, and when using the stale cap memory in the callbacks\nit will trigger use-after-free crash.\n\nWe need to check the existence of the cap just after the \u0027ci-\u003ei_ceph_lock\u0027\nbeing acquired. And do nothing if it\u0027s already removed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Every caller of the vulnerable `ceph_iterate_session_caps()` is driven by a message received from the remote Ceph MDS over TCP \u2014 `CEPH_SESSION_RECALL_STATE` (trim), `CLOSE`/`REJECT` (remove_session_caps), `STALE` (renewcaps) and MDS reconnect \u2014 processed in `handle_session()` on the messenger workqueue. A malicious, compromised, or on-path-spoofed MDS reaches the code purely with network traffic.\nAC:L - The attacker drives both sides of the race: `RECALL_STATE`/session-close/reconnect storms start the cap iteration while concurrent cap-revoke/export/session messages and the callback\u0027s own `d_prune_aliases()`/inode-eviction path remove caps. The window spans sleeping operations (`d_find_primary()`, `ceph_mdsc_build_path()`, dentry pruning) and can be retried indefinitely, so it is reliably hit.\nPR:N - No credentials or privileges on the victim client are required \u2014 the malicious MDS peer needs no local authority, and the code runs unauthenticated with respect to the client\u0027s privilege model. Locally, mere unprivileged access to a mounted CephFS is enough to generate the concurrent cap churn.\nUI:N - Exploitation needs no victim action beyond an already-mounted CephFS, which is the normal operating state of an affected system; the MDS drives the whole sequence on its own.\nS:U - The stale `struct ceph_cap` corruption and the resulting oops are confined to the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The use-after-free gives a read primitive over freed/recycled `ceph_cap` slab memory, and `reconnect_caps_cb()` encodes those stale fields (`cap-\u003ecap_id`, `cap-\u003eissued`) directly into the reconnect message transmitted to the MDS, exfiltrating freed-object contents to the attacker.\nI:H - The callbacks write into the stale object \u2014 `cap-\u003eseq/issue_seq/mseq/cap_gen = 0` in `reconnect_caps_cb()` and `cap-\u003eissued = cap-\u003eimplemented = CEPH_CAP_PIN` in `wake_up_session_cb()` \u2014 corrupting a recycled `ceph_cap` (and thus another inode\u0027s capability/coherency state), a UAF write primitive usable for heap grooming toward control-flow hijack.\nA:H - The reported real-world outcome is a kernel NULL-pointer dereference oops in `__ceph_remove_cap()` from the trim-caps path (Ceph tracker #43272), and any use-after-free of the cap object crashes the client; the MDS can trigger it repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:28.667Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2b2515b8095cf2149bef44383a99d5b5677f1831"
        },
        {
          "url": "https://git.kernel.org/stable/c/448875a73e16ba7d81dec9274ce9d33a12d092fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae6e935618d99cdba11eab4714092e7e5f13cf7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/aaf67de78807c59c35bafb5003d4fb457c764800"
        }
      ],
      "title": "ceph: fix potential use-after-free bug when trimming caps",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53867",
    "datePublished": "2025-12-24T10:55:25.430Z",
    "dateReserved": "2025-12-09T01:27:17.829Z",
    "dateUpdated": "2026-08-05T09:16:28.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53867",
      "date": "2026-09-14",
      "epss": "0.00516",
      "percentile": "0.42405"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53867\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T11:15:51.387\",\"lastModified\":\"2026-08-04T10:19:24.590\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nceph: fix potential use-after-free bug when trimming caps\\n\\nWhen trimming the caps and just after the \u0027session-\u003es_cap_lock\u0027 is\\nreleased in ceph_iterate_session_caps() the cap maybe removed by\\nanother thread, and when using the stale cap memory in the callbacks\\nit will trigger use-after-free crash.\\n\\nWe need to check the existence of the cap just after the \u0027ci-\u003ei_ceph_lock\u0027\\nbeing acquired. And do nothing if it\u0027s already removed.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ceph/caps.c\",\"fs/ceph/debugfs.c\",\"fs/ceph/mds_client.c\",\"fs/ceph/mds_client.h\",\"fs/ceph/super.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2f2dc053404febedc9c273452d9d518fb31fde72\",\"lessThan\":\"2b2515b8095cf2149bef44383a99d5b5677f1831\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f2dc053404febedc9c273452d9d518fb31fde72\",\"lessThan\":\"448875a73e16ba7d81dec9274ce9d33a12d092fb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f2dc053404febedc9c273452d9d518fb31fde72\",\"lessThan\":\"ae6e935618d99cdba11eab4714092e7e5f13cf7e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f2dc053404febedc9c273452d9d518fb31fde72\",\"lessThan\":\"aaf67de78807c59c35bafb5003d4fb457c764800\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ceph/caps.c\",\"fs/ceph/debugfs.c\",\"fs/ceph/mds_client.c\",\"fs/ceph/mds_client.h\",\"fs/ceph/super.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.34\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.34\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.28\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2.15\",\"lessThanOrEqual\":\"6.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.3.2\",\"lessThanOrEqual\":\"6.3.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2b2515b8095cf2149bef44383a99d5b5677f1831\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/448875a73e16ba7d81dec9274ce9d33a12d092fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aaf67de78807c59c35bafb5003d4fb457c764800\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ae6e935618d99cdba11eab4714092e7e5f13cf7e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:55:02+00:00",
      "cve": "CVE-2023-53867",
      "id": "CVE-2023-53867",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "120",
      "product_status:known_affected": "152",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ceph: fix potential use-after-free bug when trimming caps",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53867.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-05T00:47:23Z",
      "cve": "CVE-2023-53867",
      "id": "CVE-2023-53867",
      "initial_release_date": "2025-12-25T00:58:23Z",
      "product_status:known_affected": "328",
      "product_status:known_not_affected": "172",
      "product_status:recommended": "49",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53867",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53867.json",
      "version": "14"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.