Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-53088— mptcp: fix UaF in listener shutdown

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mptcp监听器关闭路径存在UaF问题。

CVSS 7.8 · High EPSS 0.20% · P10

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux 6aeed9045071f2252ff4e98fc13d1e304f33e5b0< 5564be74a22a61855f8b8c100d8c4abb003bb792 affected
6aeed9045071f2252ff4e98fc13d1e304f33e5b0< 0f4f4cf5d32f10543deb946a37111e714579511e affected
6aeed9045071f2252ff4e98fc13d1e304f33e5b0< 0a3f4f1f9c27215e4ddcd312558342e57b93e518 affected
a8a3e95c74e48c2c9b07b81fafda9122993f2e12 affected
5.18.10< 5.19 affected
5.19 affected
< 5.19 unaffected
6.1.22≤ 6.1.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-53088

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mptcp: fix UaF in listener shutdown
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix UaF in listener shutdown As reported by Christoph after having refactored the passive socket initialization, the mptcp listener shutdown path is prone to an UaF issue. BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x73/0xe0 Write of size 4 at addr ffff88810cb23098 by task syz-executor731/1266 CPU: 1 PID: 1266 Comm: syz-executor731 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x6e/0x91 print_report+0x16a/0x46f kasan_report+0xad/0x130 kasan_check_range+0x14a/0x1a0 _raw_spin_lock_bh+0x73/0xe0 subflow_error_report+0x6d/0x110 sk_error_report+0x3b/0x190 tcp_disconnect+0x138c/0x1aa0 inet_child_forget+0x6f/0x2e0 inet_csk_listen_stop+0x209/0x1060 __mptcp_close_ssk+0x52d/0x610 mptcp_destroy_common+0x165/0x640 mptcp_destroy+0x13/0x80 __mptcp_destroy_sock+0xe7/0x270 __mptcp_close+0x70e/0x9b0 mptcp_close+0x2b/0x150 inet_release+0xe9/0x1f0 __sock_release+0xd2/0x280 sock_close+0x15/0x20 __fput+0x252/0xa20 task_work_run+0x169/0x250 exit_to_user_mode_prepare+0x113/0x120 syscall_exit_to_user_mode+0x1d/0x40 do_syscall_64+0x48/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc The msk grace period can legitly expire in between the last reference count dropped in mptcp_subflow_queue_clean() and the later eventual access in inet_csk_listen_stop() After the previous patch we don't need anymore special-casing msk listener socket cleanup: the mptcp worker will process each of the unaccepted msk sockets. Just drop the now unnecessary code. Please note this commit depends on the two parent ones: mptcp: refactor passive socket initialization mptcp: use the workqueue to destroy unaccepted sockets
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mptcp监听器关闭路径存在UaF问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 6aeed9045071f2252ff4e98fc13d1e304f33e5b0 ~ 5564be74a22a61855f8b8c100d8c4abb003bb792 -
Linux Linux 5.19 -

II. Public POCs for CVE-2023-53088

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-53088

请登录查看更多情报信息。

Patches & Fixes for CVE-2023-53088 (3)

Same Patch Batch · Linux · 2025-05-02 · 107 CVEs total

CVE-2023-53116 9.8 CRITICAL nvmet: avoid potential UAF in nvmet_req_complete()
CVE-2023-53083 9.8 CRITICAL nfsd: don't replace page in rq_pages if it's a continuation of last page
CVE-2023-53086 8.8 HIGH wifi: mt76: connac: do not check WED status for non-mmio devices
CVE-2025-37798 7.8 HIGH codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
CVE-2023-53138 7.8 HIGH net: caif: Fix use-after-free in cfusbl_device_notify()
CVE-2023-53111 7.8 HIGH loop: Fix use-after-free issues
CVE-2023-53107 7.8 HIGH veth: Fix use after free in XDP_REDIRECT
CVE-2023-53102 7.8 HIGH ice: xsk: disable txq irq before flushing hw
CVE-2023-53100 7.8 HIGH ext4: fix WARNING in ext4_update_inline_data
CVE-2023-53094 7.8 HIGH tty: serial: fsl_lpuart: fix race on RX DMA shutdown
CVE-2023-53090 7.8 HIGH drm/amdkfd: Fix an illegal memory access
CVE-2023-53087 7.8 HIGH drm/i915/active: Fix misuse of non-idle barriers as fence trackers
CVE-2023-53084 7.8 HIGH drm/shmem-helper: Remove another errant put in error path
CVE-2023-53080 7.8 HIGH xsk: Add missing overflow check in xdp_umem_reg
CVE-2023-53072 7.8 HIGH mptcp: use the workqueue to destroy unaccepted sockets
CVE-2023-53065 7.8 HIGH perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output
CVE-2023-53057 7.8 HIGH Bluetooth: HCI: Fix global-out-of-bounds
CVE-2023-53052 7.8 HIGH cifs: fix use-after-free bug in refresh_cache_worker()
CVE-2023-53047 7.8 HIGH tee: amdtee: fix race condition in amdtee_open_session
CVE-2023-53039 7.8 HIGH HID: intel-ish-hid: ipc: Fix potential use-after-free in work function

Showing top 20 of 107 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2023-53088

No comments yet

Leave a comment