linux-cve-announce - CVE-2023-53218: rxrpc: Make it so that a waiting process can be aborted

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091512-CVE-2023-53218-0fca@gregkh>
Date: Mon, 15 Sep 2025 16:21:52 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53218: rxrpc: Make it so that a waiting process can be aborted

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Make it so that a waiting process can be aborted

When sendmsg() creates an rxrpc call, it queues it to wait for a connection
and channel to be assigned and then waits before it can start shovelling
data as the encrypted DATA packet content includes a summary of the
connection parameters.

However, sendmsg() may get interrupted before a connection gets assigned
and further sendmsg() calls will fail with EBUSY until an assignment is
made.

Fix this so that the call can at least be aborted without failing on
EBUSY.  We have to be careful here as sendmsg() mustn't be allowed to start
the call timer if the call doesn't yet have a connection assigned as an
oops may follow shortly thereafter.

The Linux kernel CVE team has assigned CVE-2023-53218 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 4.11 with commit 540b1c48c37ac0ad66212004db21e1ff7e2d78be and fixed in 6.2.16 with commit 7161cf61c64e9e9413d790f2fa2b9dada71a2249
	Issue introduced in 4.11 with commit 540b1c48c37ac0ad66212004db21e1ff7e2d78be and fixed in 6.3.3 with commit 876d96faacbc407daf4978d7ec95051b68f5344a
	Issue introduced in 4.11 with commit 540b1c48c37ac0ad66212004db21e1ff7e2d78be and fixed in 6.4 with commit 0eb362d254814ce04848730bf32e75b8ee1a4d6c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53218
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	net/rxrpc/sendmsg.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7161cf61c64e9e9413d790f2fa2b9dada71a2249
	https://git.kernel.org/stable/c/876d96faacbc407daf4978d7ec95051b68f5344a
	https://git.kernel.org/stable/c/0eb362d254814ce04848730bf32e75b8ee1a4d6c