« Volver al listado

CVE-2023-53511

Estado: AnalizadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix fget leak when fs don't support nowait buffered read

Heming reported a BUG when using io_uring doing link-cp on ocfs2. [1]

Do the following steps can reproduce this BUG: mount -t ocfs2 /dev/vdc /mnt/ocfs2 cp testfile /mnt/ocfs2/ ./link-cp /mnt/ocfs2/testfile /mnt/ocfs2/testfile.1 umount /mnt/ocfs2

Then umount will fail, and it outputs: umount: /mnt/ocfs2: target is busy.

While tracing umount, it blames mnt_get_count() not return as expected. Do a deep investigation for fget()/fput() on related code flow, I've finally found that fget() leaks since ocfs2 doesn't support nowait buffered read.

Leer descripción completaMostrar menos

This was introduced by commit a196c78b5443 in v5.18. Fix it by don't re-assign req->file if it has already been assigned.

[1] https://lore.kernel.org/ocfs2-devel/ab580a75-91c8-d68a-3455-40361be1bfa8@linux.alibaba.com/T/#t

Detalles técnicos trazas, registros y código del informe original
io_issue_sqe
|-io_assign_file  // do fget() first
  |-io_read
  |-io_iter_do_read
    |-ocfs2_file_read_iter  // return -EOPNOTSUPP
  |-kiocb_done
    |-io_rw_done
      |-__io_complete_rw_common  // set REQ_F_REISSUE
    |-io_resubmit_prep
      |-io_req_prep_async  // override req->file, leak happens

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-53511",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "a196c78b5443fc61af2c0490213b9d125482cbd1",
              "lessThan": "75a499fc9d66a32271e2b3e4ca71156e8ad3b484",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a196c78b5443fc61af2c0490213b9d125482cbd1",
              "lessThan": "10fb2e16ee6ffaf1716b9e90d007e6b300bfa457",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a196c78b5443fc61af2c0490213b9d125482cbd1",
              "lessThan": "54aa7f2330b82884f4a1afce0220add6e8312f8b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cef27a7d36026bd3c86f4fdfb4611ebbe2814af4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5.17.9",
              "lessThan": "5.18",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "io_uring/io_uring.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.18",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.16",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.2.3",
              "versionType": "semver",
              "lessThanOrEqual": "6.2.*"
            },
            {
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "io_uring/io_uring.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-10-01T12:15:55.030",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/10fb2e16ee6ffaf1716b9e90d007e6b300bfa457",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/54aa7f2330b82884f4a1afce0220add6e8312f8b",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/75a499fc9d66a32271e2b3e4ca71156e8ad3b484",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring: fix fget leak when fs don't support nowait buffered read\n\nHeming reported a BUG when using io_uring doing link-cp on ocfs2. [1]\n\nDo the following steps can reproduce this BUG:\nmount -t ocfs2 /dev/vdc /mnt/ocfs2\ncp testfile /mnt/ocfs2/\n./link-cp /mnt/ocfs2/testfile /mnt/ocfs2/testfile.1\numount /mnt/ocfs2\n\nThen umount will fail, and it outputs:\numount: /mnt/ocfs2: target is busy.\n\nWhile tracing umount, it blames mnt_get_count() not return as expected.\nDo a deep investigation for fget()/fput() on related code flow, I've\nfinally found that fget() leaks since ocfs2 doesn't support nowait\nbuffered read.\n\nio_issue_sqe\n|-io_assign_file  // do fget() first\n  |-io_read\n  |-io_iter_do_read\n    |-ocfs2_file_read_iter  // return -EOPNOTSUPP\n  |-kiocb_done\n    |-io_rw_done\n      |-__io_complete_rw_common  // set REQ_F_REISSUE\n    |-io_resubmit_prep\n      |-io_req_prep_async  // override req->file, leak happens\n\nThis was introduced by commit a196c78b5443 in v5.18. Fix it by don't\nre-assign req->file if it has already been assigned.\n\n[1] https://lore.kernel.org/ocfs2-devel/ab580a75-91c8-d68a-3455-40361be1bfa8@linux.alibaba.com/T/#t"
    }
  ],
  "lastModified": "2026-06-17T06:45:30.170",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "237FF665-63EB-4FB8-B2DC-5BD5D79B8053",
              "versionEndExcluding": "5.18",
              "versionStartIncluding": "5.17.9"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2EF76361-0A42-48AE-BC0D-99DAB44B5118",
              "versionEndExcluding": "6.1.16",
              "versionStartIncluding": "5.18.1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "88C67289-22AD-4CA9-B202-5F5A80E5BA4B",
              "versionEndExcluding": "6.2.3",
              "versionStartIncluding": "6.2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.18:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0384FA0A-DE99-48D7-84E3-46ED0C3B5E03"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.18:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE723F14-047B-4FCF-B109-E0542EDFB063"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.18:rc7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FCFCE58-5118-4D05-864E-C82CF20EABE5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}