CVE-2023-53867
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
In the Linux kernel's ceph module, a potential use-after-free bug exists when trimming caps. After releasing 'session->s_cap_lock', another thread may remove the cap, and using stale memory in callbacks causes a crash. The fix checks cap existence after acquiring 'ci->i_ceph_lock'.
Risk Assessment
This vulnerability could lead to system crashes or potential privilege escalation in environments using Ceph.
Recommendation
Apply the Linux kernel update containing the fix for CVE-2023-53867. Prioritize systems with Ceph.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ceph: fix potential use-after-free bug when trimming caps When trimming the caps and just after the 'session->s_cap_lock' is released in ceph_iterate_session_caps() the cap maybe removed by another thread, and when using the stale cap memory in the callbacks it will trigger use-after-free crash. We need to check the existence of the cap just after the 'ci->i_ceph_lock' being acquired. And do nothing if it's already removed.