What is CVE-2023-52851?

CVE-2023-52851 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, affecting Linux kernel versions from 5.19 onward and patched in 6.1.63, 6.5.12, 6.6.2 and others. CVE-2023-52851 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2023-52851?

CVE-2023-52851 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2023-52851?

Yes, CVE-2023-52851 has been patched. Fixed versions include 6.1.63, 6.5.12, 6.6.2 and others. If you are running Linux kernel 5.19 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2023-52851 actively exploited?

CVE-2023-52851 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2023-52851

High

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF In the unlikely event that workqueue allocation fails and returns NULL in mlx5_mkey_cache_init(), delete the call to mlx5r_umr_resource_cleanup() (which frees the QP) in mlx5_ib_stage_post_ib_reg_umr_init(). This will avoid attempted double free of the same QP when __mlx5_ib_add() does its cleanup. Resolves a splat: Syzkaller reported a UAF in ib_destroy_qp_user workqueue: Failed to create a rescuer kthread for wq "mkey_cache": -EINTR infiniband mlx5_0: mlx5_mkey_cache_init:981:(pid 1642): failed to create work queue infiniband mlx5_0: mlx5_ib_stage_post_ib_reg_umr_init:4075:(pid 1642): mr cache init failed -12 ================================================================== BUG: KASAN: slab-use-after-free in ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) Read of size 8 at addr ffff88810da310a8 by task repro_upstream/1642 Call Trace: <TASK> kasan_report (mm/kasan/report.c:590) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4178) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ... </TASK> Allocated by task 1642: __kmalloc (./include/linux/kasan.h:198 mm/slab_common.c:1026 mm/slab_common.c:1039) create_qp (./include/linux/slab.h:603 ./include/linux/slab.h:720 ./include/rdma/ib_verbs.h:2795 drivers/infiniband/core/verbs.c:1209) ib_create_qp_kernel (drivers/infiniband/core/verbs.c:1347) mlx5r_umr_resource_init (drivers/infiniband/hw/mlx5/umr.c:164) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4070) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ... Freed by task 1642: __kmem_cache_free (mm/slub.c:1826 mm/slub.c:3809 mm/slub.c:3822) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2112) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4076 drivers/infiniband/hw/mlx5/main.c:4065) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ...

Package Linux Kernel

Published 2024-05-21

Last modified 2025-01-10

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type

CWE-415

CVE-2023-52851 is classified as CWE-415

See CWE-415 on MITRE CWE for full details on this weakness type.

Affected versions

Linux kernel versions 5.19 and later are affected. Fixed in 6.1.63, 6.5.12, 6.6.2, 6.7 and their respective stable series.

Affected from

≥ 5.19

Fixed in

✓ 6.1.63 6.1.x ✓ 6.5.12 6.5.x ✓ 6.6.2 6.6.x ✓ 6.7

References

4 total

Kernel Git
https://git.kernel.org/stable/c/2ef422f063b74adcc4a4a9004b0a87bb55e0a836

Patch
Kernel Git
https://git.kernel.org/stable/c/437f033e30c897bb3723eac9e9003cd9f88d00a3

Patch
Kernel Git
https://git.kernel.org/stable/c/4f4a7a7d1404297f2a92df0046f7e64dc5c52dd9

Patch
Kernel Git
https://git.kernel.org/stable/c/6387f269d84e6e149499408c4d1fc805017729b2

Patch

Details

CVE ID CVE-2023-52851

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2024-05-21

Modified 2025-01-10

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2023-52851?

CVE-2023-52851 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 . It affects Linux kernel versions from 5.19 onward and has been patched in 6.1.63, 6.5.12, 6.6.2 and others. CVE-2023-52851 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2023-52851?

CVE-2023-52851 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2023-52851?

Yes. CVE-2023-52851 has been patched. Fixed versions include 6.1.63, 6.5.12, 6.6.2 and others. If you are running Linux kernel 5.19 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2023-52851 actively exploited?

No. CVE-2023-52851 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.