CVE-2023-53083

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-53083
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53083.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-53083
Downstream
Published
2025-05-02T15:55:31Z
Modified
2025-10-14T09:37:27.328172Z
Summary
nfsd: don't replace page in rq_pages if it's a continuation of last page
Details

In the Linux kernel, the following vulnerability has been resolved:

nfsd: don't replace page in rq_pages if it's a continuation of last page

The splice read calls nfsdspliceactor to put the pages containing file data into the svcrqst->rqpages array. It's possible however to get a splice result that only has a partial page at the end, if (e.g.) the filesystem hands back a short read that doesn't cover the whole page.

nfsdspliceactor will plop the partial page into its rqpages array and return. Then later, when nfsdspliceactor is called again, the remainder of the page may end up being filled out. At this point, nfsdspliceactor will put the page into the array _again corrupting the reply. If this is done enough times, rqnextpage will overrun the array and corrupt the trailing fields -- the rqrespages and rqnext_page pointers themselves.

If we've already added the page to the array in the last pass, don't add it to the array a second time when dealing with a splice continuation. This was originally handled properly in nfsdspliceactor, but commit 91e23b1c3982 ("NFSD: Clean up nfsdspliceactor()") removed the check for it.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
bf1cbe2f3650b4f4a8add6af933c6d7f6af1f361
Fixed
8235cd619db6e67f1d7d26c55f1f3e4e575c947d
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
56bc7e3821e847a6cc8027ddaba32e9a440225a5
Fixed
12eca509234acb6b666802edf77408bb70d7bfca
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
91e23b1c39820bfed642119ff6b6ef9f43cf09ce
Fixed
51ddb84baff6f09ad62b5999ece3ec172e4e3568
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
91e23b1c39820bfed642119ff6b6ef9f43cf09ce
Fixed
0101067f376eb7b9afd00279270f25d5111a091d
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
91e23b1c39820bfed642119ff6b6ef9f43cf09ce
Fixed
27c934dd8832dd40fd34776f916dc201e18b319b

Affected versions

v5.*

v5.18
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8

v6.*

v6.0
v6.0-rc1
v6.0-rc2
v6.0-rc3
v6.0-rc4
v6.0-rc5
v6.0-rc6
v6.0-rc7
v6.1
v6.1-rc1
v6.1-rc2
v6.1-rc3
v6.1-rc4
v6.1-rc5
v6.1-rc6
v6.1-rc7
v6.1-rc8
v6.1.1
v6.1.10
v6.1.11
v6.1.12
v6.1.13
v6.1.14
v6.1.15
v6.1.16
v6.1.17
v6.1.18
v6.1.19
v6.1.2
v6.1.20
v6.1.21
v6.1.3
v6.1.4
v6.1.5
v6.1.6
v6.1.7
v6.1.8
v6.1.9
v6.2
v6.2-rc1
v6.2-rc2
v6.2-rc3
v6.2-rc4
v6.2-rc5
v6.2-rc6
v6.2-rc7
v6.2-rc8
v6.2.1
v6.2.2
v6.2.3
v6.2.4
v6.2.5
v6.2.6
v6.2.7
v6.2.8

Database specific 

{
    "vanir_signatures": [
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8235cd619db6e67f1d7d26c55f1f3e4e575c947d",
            "signature_type": "Function",
            "digest": {
                "function_hash": "55593491769026953191303895940830327282",
                "length": 467.0
            },
            "id": "CVE-2023-53083-3ced4d12",
            "target": {
                "file": "fs/nfsd/vfs.c",
                "function": "nfsd_splice_actor"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0101067f376eb7b9afd00279270f25d5111a091d",
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "314015254552213860254801013925745785517",
                    "137187167142239072850239675970066735078",
                    "79817754019158952893547808846290474237",
                    "284128574995409957643319477069405101512",
                    "69636172588797729822345636015944075675"
                ]
            },
            "id": "CVE-2023-53083-468f28b1",
            "target": {
                "file": "fs/nfsd/vfs.c"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51ddb84baff6f09ad62b5999ece3ec172e4e3568",
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "314015254552213860254801013925745785517",
                    "137187167142239072850239675970066735078",
                    "79817754019158952893547808846290474237",
                    "284128574995409957643319477069405101512",
                    "69636172588797729822345636015944075675"
                ]
            },
            "id": "CVE-2023-53083-591a06a4",
            "target": {
                "file": "fs/nfsd/vfs.c"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12eca509234acb6b666802edf77408bb70d7bfca",
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "314015254552213860254801013925745785517",
                    "137187167142239072850239675970066735078",
                    "79817754019158952893547808846290474237",
                    "284128574995409957643319477069405101512",
                    "69636172588797729822345636015944075675"
                ]
            },
            "id": "CVE-2023-53083-7ae08f46",
            "target": {
                "file": "fs/nfsd/vfs.c"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0101067f376eb7b9afd00279270f25d5111a091d",
            "signature_type": "Function",
            "digest": {
                "function_hash": "55593491769026953191303895940830327282",
                "length": 467.0
            },
            "id": "CVE-2023-53083-7fe71f32",
            "target": {
                "file": "fs/nfsd/vfs.c",
                "function": "nfsd_splice_actor"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8235cd619db6e67f1d7d26c55f1f3e4e575c947d",
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "314015254552213860254801013925745785517",
                    "137187167142239072850239675970066735078",
                    "79817754019158952893547808846290474237",
                    "284128574995409957643319477069405101512",
                    "69636172588797729822345636015944075675"
                ]
            },
            "id": "CVE-2023-53083-86d44832",
            "target": {
                "file": "fs/nfsd/vfs.c"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51ddb84baff6f09ad62b5999ece3ec172e4e3568",
            "signature_type": "Function",
            "digest": {
                "function_hash": "55593491769026953191303895940830327282",
                "length": 467.0
            },
            "id": "CVE-2023-53083-abcd014e",
            "target": {
                "file": "fs/nfsd/vfs.c",
                "function": "nfsd_splice_actor"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12eca509234acb6b666802edf77408bb70d7bfca",
            "signature_type": "Function",
            "digest": {
                "function_hash": "55593491769026953191303895940830327282",
                "length": 467.0
            },
            "id": "CVE-2023-53083-caa8a4a6",
            "target": {
                "file": "fs/nfsd/vfs.c",
                "function": "nfsd_splice_actor"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27c934dd8832dd40fd34776f916dc201e18b319b",
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "314015254552213860254801013925745785517",
                    "137187167142239072850239675970066735078",
                    "79817754019158952893547808846290474237",
                    "284128574995409957643319477069405101512",
                    "69636172588797729822345636015944075675"
                ]
            },
            "id": "CVE-2023-53083-ea1a6525",
            "target": {
                "file": "fs/nfsd/vfs.c"
            },
            "deprecated": false,
            "signature_version": "v1"
        },
        {
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@27c934dd8832dd40fd34776f916dc201e18b319b",
            "signature_type": "Function",
            "digest": {
                "function_hash": "55593491769026953191303895940830327282",
                "length": 467.0
            },
            "id": "CVE-2023-53083-f2c89b00",
            "target": {
                "file": "fs/nfsd/vfs.c",
                "function": "nfsd_splice_actor"
            },
            "deprecated": false,
            "signature_version": "v1"
        }
    ]
}

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.19.0
Fixed
6.1.22
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.2.9