CVE-2023-52837

HighCVSS 7.8/10Last modified Aug 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nbd: fix uaf in nbd_open

Commit 4af5f2e03013 ("nbd: use blk_mq_alloc_disk and blk_cleanup_disk") cleans up disk by blk_cleanup_disk() and it won't set disk->private_data as NULL as before. UAF may be triggered in nbd_open() if someone tries to open nbd device right after nbd_put() since nbd has been free in nbd_dev_remove().

Fix this by implementing ->free_disk and free private data in it.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
LinuxLinux>= 4af5f2e0301311f88c420fcfc5f3c8611ade20ac, < 4e9b3ec84dc97909876641dad14e0a2300d6c2a3; >= 4af5f2e0301311f88c420fcfc5f3c8611ade20ac, < 879947f4180bc6e83af64eb0515e0cf57fce15db; >= 4af5f2e0301311f88c420fcfc5f3c8611ade20ac, < 56bd7901b5e9dbc9112036ea615ebcba1565fafe; >= 4af5f2e0301311f88c420fcfc5f3c8611ade20ac, < 327462725b0f759f093788dfbcb2f1fd132f956b
LinuxLinux5.14

References

Timeline

Published
May 21, 2024
Last modified
Aug 4, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-528386.2In the Linux kernel, the following vulnerability has been resolved: fbdev: imsttfb: fix a resource leak in probe I've re-written the errorCVE-2023-528393.3In the Linux kernel, the following vulnerability has been resolved: drivers: perf: Do not broadcast to other cpus when starting a counter CVE-2023-52848.8A vulnerability classified as critical has been found in SourceCodester Engineers Online Portal 1.0. Affected is an unknown function of the CVE-2023-528407.8In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()CVE-2023-528415.5In the Linux kernel, the following vulnerability has been resolved: media: vidtv: mux: Add check and kfree for kstrdup Add check for the rCVE-2023-528427.1In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Fix uninit-value in virtio_transport_recv_pkt() KMSAN reCVE-2023-528435.5In the Linux kernel, the following vulnerability has been resolved: llc: verify mac len before reading mac header LLC reads the mac headerCVE-2023-528446.2In the Linux kernel, the following vulnerability has been resolved: media: vidtv: psi: Add check for kstrdup Add check for the return valuCVE-2023-528455.5In the Linux kernel, the following vulnerability has been resolved: tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING syzCVE-2023-528467.8In the Linux kernel, the following vulnerability has been resolved: hsr: Prevent use after free in prp_create_tagged_frame() The prp_fill_CVE-2023-528477.0In the Linux kernel, the following vulnerability has been resolved: media: bttv: fix use after free error due to btv->timeout timer There CVE-2023-528485.5In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to drop meta_inode's page cache in f2fs_put_super() syzbot r