CVE-2023-52654
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-52654
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-52654.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-52654
- Downstream
- Related
- Published
- 2024-05-14T14:23:13Z
- Modified
- 2025-09-18T17:01:35Z
- Severity
-
- 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
iouring/afunix: disable sending io_uring over sockets
File reference cycles have caused lots of problems for iouring in the past, and it still doesn't work exactly right and races with unixstreamreadgeneric(). The safest fix would be to completely disallow sending iouring files via sockets via SCMRIGHT, so there are no possible cycles invloving registered files and thus rendering SCM accounting on the io_uring side unnecessary.
- References
-
- https://git.kernel.org/stable/c/18824f592aad4124d79751bbc1500ea86ac3ff29
- https://git.kernel.org/stable/c/3fe1ea5f921bf5b71cbfdc4469fb96c05936610e
- https://git.kernel.org/stable/c/5a33d385eb36991a91e3dddb189d8679e2aac2be
- https://git.kernel.org/stable/c/705318a99a138c29a512a72c3e0043b3cd7f55f4
- https://git.kernel.org/stable/c/bcedd497b3b4a0be56f3adf7c7542720eced0792
- https://git.kernel.org/stable/c/f2f57f51b53be153a522300454ddb3887722fb2c