CVE-2023-52636

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-52636", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-06T09:52:12.093Z", "datePublished": "2024-04-02T07:01:38.187Z", "dateUpdated": "2026-08-05T09:10:48.688Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:10:48.688Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: just wait for more data to be available on the socket\n\nA short read may occur while reading the message footer from the\nsocket. Later, when the socket is ready for another read, the\nmessenger invokes all read_partial_*() handlers, including\nread_partial_sparse_msg_data(). The expectation is that\nread_partial_sparse_msg_data() would bail, allowing the messenger to\ninvoke read_partial() for the footer and pick up where it left off.\n\nHowever read_partial_sparse_msg_data() violates that and ends up\ncalling into the state machine in the OSD client. The sparse-read\nstate machine assumes that it's a new op and interprets some piece of\nthe footer as the sparse-read header and returns bogus extents/data\nlength, etc.\n\nTo determine whether read_partial_sparse_msg_data() should bail, let's\nreuse cursor->total_resid. Because once it reaches to zero that means\nall the extents and data have been successfully received in last read,\nelse it could break out when partially reading any of the extents and\ndata. And then osd_sparse_read() could continue where it left off.\n\n[ idryomov: changelog ]"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 8.2, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable path is in libceph's msgr1 TCP receive handler processing sparse-read replies from a remote Ceph OSD peer; a malicious or compromised OSD can deliver the triggering message over the network.\nAC:L - An attacking OSD fully controls response content and TCP segmentation, so it can reliably force a short read exactly after sparse payload completion and supply footer bytes that the state machine misinterprets.\nPR:N - Exploitation requires no privileges on the victim host; the attacker acts as a remote OSD peer already speaking the Ceph protocol to the client, analogous to other malicious-server client parser bugs.\nUI:N - Once CephFS is mounted with sparse reads in use (encrypted inodes or sparseread), ordinary client I/O drives the vulnerable receive path without further user action.\nS:U - Impact is confined to the local kernel Ceph client; there is no VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:N - The bug misparses on-wire footer/extent metadata and may overwrite the intended read buffer or fault the connection, but it does not disclose kernel memory or provide an arbitrary read primitive.\nI:L - Re-entering the sparse-read machine can re-initialize the cursor and write misparsed footer/stream bytes into the in-progress page-cache read buffer, corrupting that data in a limited, buffer-bounded way rather than enabling arbitrary kernel writes.\nA:H - Misparsed extent counts drive huge allocations (observed ~2.2B extents), connection faults, allocator WARNs, and cursor overruns that hit BUG_ON, denying Ceph I/O and potentially crashing the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/ceph/messenger.h", "net/ceph/messenger_v1.c", "net/ceph/messenger_v2.c", "net/ceph/osd_client.c"], "versions": [{"version": "d396f89db39a2f259e2125ca43b4c31bb65afcad", "lessThan": "da9c33a70f095d5d55c36d0bfeba969e31de08ae", "status": "affected", "versionType": "git"}, {"version": "d396f89db39a2f259e2125ca43b4c31bb65afcad", "lessThan": "bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8", "status": "affected", "versionType": "git"}, {"version": "d396f89db39a2f259e2125ca43b4c31bb65afcad", "lessThan": "8e46a2d068c92a905d01cbb018b00d66991585ab", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/ceph/messenger.h", "net/ceph/messenger_v1.c", "net/ceph/messenger_v2.c", "net/ceph/osd_client.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.17", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.5", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.7.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae"}, {"url": "https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8"}, {"url": "https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab"}], "title": "libceph: just wait for more data to be available on the socket", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:03:21.209Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52636", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:53:29.480667Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:37.157Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:03:21.209Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52636", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:53:29.480667Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:17.655Z"}}], "cna": {"title": "libceph: just wait for more data to be available on the socket", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable path is in libceph's msgr1 TCP receive handler processing sparse-read replies from a remote Ceph OSD peer; a malicious or compromised OSD can deliver the triggering message over the network.\nAC:L - An attacking OSD fully controls response content and TCP segmentation, so it can reliably force a short read exactly after sparse payload completion and supply footer bytes that the state machine misinterprets.\nPR:N - Exploitation requires no privileges on the victim host; the attacker acts as a remote OSD peer already speaking the Ceph protocol to the client, analogous to other malicious-server client parser bugs.\nUI:N - Once CephFS is mounted with sparse reads in use (encrypted inodes or sparseread), ordinary client I/O drives the vulnerable receive path without further user action.\nS:U - Impact is confined to the local kernel Ceph client; there is no VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:N - The bug misparses on-wire footer/extent metadata and may overwrite the intended read buffer or fault the connection, but it does not disclose kernel memory or provide an arbitrary read primitive.\nI:L - Re-entering the sparse-read machine can re-initialize the cursor and write misparsed footer/stream bytes into the in-progress page-cache read buffer, corrupting that data in a limited, buffer-bounded way rather than enabling arbitrary kernel writes.\nA:H - Misparsed extent counts drive huge allocations (observed ~2.2B extents), connection faults, allocator WARNs, and cursor overruns that hit BUG_ON, denying Ceph I/O and potentially crashing the kernel."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad", "lessThan": "da9c33a70f095d5d55c36d0bfeba969e31de08ae", "versionType": "git"}, {"status": "affected", "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad", "lessThan": "bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8", "versionType": "git"}, {"status": "affected", "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad", "lessThan": "8e46a2d068c92a905d01cbb018b00d66991585ab", "versionType": "git"}], "programFiles": ["include/linux/ceph/messenger.h", "net/ceph/messenger_v1.c", "net/ceph/messenger_v2.c", "net/ceph/osd_client.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"status": "unaffected", "version": "0", "lessThan": "6.6", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.17", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.5", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/linux/ceph/messenger.h", "net/ceph/messenger_v1.c", "net/ceph/messenger_v2.c", "net/ceph/osd_client.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae"}, {"url": "https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8"}, {"url": "https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: just wait for more data to be available on the socket\n\nA short read may occur while reading the message footer from the\nsocket. Later, when the socket is ready for another read, the\nmessenger invokes all read_partial_*() handlers, including\nread_partial_sparse_msg_data(). The expectation is that\nread_partial_sparse_msg_data() would bail, allowing the messenger to\ninvoke read_partial() for the footer and pick up where it left off.\n\nHowever read_partial_sparse_msg_data() violates that and ends up\ncalling into the state machine in the OSD client. The sparse-read\nstate machine assumes that it's a new op and interprets some piece of\nthe footer as the sparse-read header and returns bogus extents/data\nlength, etc.\n\nTo determine whether read_partial_sparse_msg_data() should bail, let's\nreuse cursor->total_resid. Because once it reaches to zero that means\nall the extents and data have been successfully received in last read,\nelse it could break out when partially reading any of the extents and\ndata. And then osd_sparse_read() could continue where it left off.\n\n[ idryomov: changelog ]"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.17", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.5", "versionStartIncluding": "6.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "6.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:10:48.688Z"}}}, "cveMetadata": {"cveId": "CVE-2023-52636", "state": "PUBLISHED", "dateUpdated": "2026-08-05T09:10:48.688Z", "dateReserved": "2024-03-06T09:52:12.093Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-02T07:01:38.187Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/ceph/messenger.h", "net/ceph/messenger_v1.c", "net/ceph/messenger_v2.c", "net/ceph/osd_client.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "da9c33a70f095d5d55c36d0bfeba969e31de08ae", "status": "affected", "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad", "versionType": "git"}, {"lessThan": "bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8", "status": "affected", "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad", "versionType": "git"}, {"lessThan": "8e46a2d068c92a905d01cbb018b00d66991585ab", "status": "affected", "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/ceph/messenger.h", "net/ceph/messenger_v1.c", "net/ceph/messenger_v2.c", "net/ceph/osd_client.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.17", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0B77B682-A9FE-43C2-9370-B5523C080B80", "versionEndExcluding": "6.6.17", "versionStartIncluding": "6.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "01925741-2C95-47C1-A7EA-3DC2BB0012D3", "versionEndExcluding": "6.7.5", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*", "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*", "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*", "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: just wait for more data to be available on the socket\n\nA short read may occur while reading the message footer from the\nsocket. Later, when the socket is ready for another read, the\nmessenger invokes all read_partial_*() handlers, including\nread_partial_sparse_msg_data(). The expectation is that\nread_partial_sparse_msg_data() would bail, allowing the messenger to\ninvoke read_partial() for the footer and pick up where it left off.\n\nHowever read_partial_sparse_msg_data() violates that and ends up\ncalling into the state machine in the OSD client. The sparse-read\nstate machine assumes that it's a new op and interprets some piece of\nthe footer as the sparse-read header and returns bogus extents/data\nlength, etc.\n\nTo determine whether read_partial_sparse_msg_data() should bail, let's\nreuse cursor->total_resid. Because once it reaches to zero that means\nall the extents and data have been successfully received in last read,\nelse it could break out when partially reading any of the extents and\ndata. And then osd_sparse_read() could continue where it left off.\n\n[ idryomov: changelog ]"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: \"libceph: just wait for more data to be available on the socket\". Puede ocurrir una lectura breve mientras se lee el pie de p\u00e1gina del mensaje desde el socket. M\u00e1s tarde, cuando el socket est\u00e1 listo para otra lectura, el mensajero invoca todos los controladores read_partial_*(), incluido read_partial_sparse_msg_data(). La expectativa es que read_partial_sparse_msg_data() saldr\u00eda, permitiendo al mensajero invocar read_partial() para el pie de p\u00e1gina y continuar donde lo dej\u00f3. Sin embargo, read_partial_sparse_msg_data() viola eso y termina llamando a la m\u00e1quina de estado en el cliente OSD. La m\u00e1quina de estado de lectura dispersa asume que es una nueva operaci\u00f3n e interpreta alguna parte del pie de p\u00e1gina como el encabezado de lectura dispersa y devuelve extensiones/longitud de datos falsas, etc. Para determinar si read_partial_sparse_msg_data() debe rescatarse, reutilicemos cursor->total_resid . Porque una vez que llega a cero, significa que todas las extensiones y datos se recibieron correctamente en la \u00faltima lectura; de lo contrario, podr\u00eda romperse al leer parcialmente cualquiera de las extensiones y datos. Y luego osd_sparse_read() podr\u00eda continuar donde lo dej\u00f3. [idryomov: registro de cambios]"}], "id": "CVE-2023-52636", "lastModified": "2026-08-04T10:18:35.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-52636", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:53:29.480667Z", "version": "2.0.3"}}]}, "published": "2024-04-02T07:15:41.337", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: libceph: just wait for more data to be available on the socket", "id": "2272820", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272820"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-20", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nlibceph: just wait for more data to be available on the socket\nA short read may occur while reading the message footer from the\nsocket. Later, when the socket is ready for another read, the\nmessenger invokes all read_partial_*() handlers, including\nread_partial_sparse_msg_data(). The expectation is that\nread_partial_sparse_msg_data() would bail, allowing the messenger to\ninvoke read_partial() for the footer and pick up where it left off.\nHowever read_partial_sparse_msg_data() violates that and ends up\ncalling into the state machine in the OSD client. The sparse-read\nstate machine assumes that it's a new op and interprets some piece of\nthe footer as the sparse-read header and returns bogus extents/data\nlength, etc.\nTo determine whether read_partial_sparse_msg_data() should bail, let's\nreuse cursor->total_resid. Because once it reaches to zero that means\nall the extents and data have been successfully received in last read,\nelse it could break out when partially reading any of the extents and\ndata. And then osd_sparse_read() could continue where it left off.\n[ idryomov: changelog ]"], "name": "CVE-2023-52636", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-02T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-52636\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-52636\nhttps://lore.kernel.org/linux-cve-announce/2024040249-CVE-2023-52636-d965@gregkh/T"], "threat_severity": "Low"}

{}