CVE-2023-52513: RDMA/siw: Fix connection failure handling
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix connection failure handling
In case immediate MPA request processing fails, the newly created endpoint unlinks the listening endpoint and is ready to be dropped. This special case was not handled correctly by the code handling the later TCP socket close, causing a NULL dereference crash in siwcmworkhandler() when dereferencing a NULL listener. We now also cancel the useless MPA timeout, if immediate MPA request processing fails.
This patch furthermore simplifies MPA processing in general: Scheduling a useless TCP socket read in skdataready() upcall is now surpressed, if the socket is already moved out of TCPESTABLISHED state.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix connection failure handling
The Linux kernel CVE team has assigned CVE-2023-52513 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024030251-CVE-2023-52513-5224@gregkh/T/#u
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by an error related to the handling of a connection failure. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52513?
CVE-2023-52513 has been classified as having a medium severity level due to potential disruption in connection handling.
How do I fix CVE-2023-52513?
To fix CVE-2023-52513, update to the latest kernel version mentioned in the vulnerability advisory, such as 5.4.258, 5.10.198, 5.15.135, 6.1.57, 6.5.7, or 6.6.
Which systems are affected by CVE-2023-52513?
CVE-2023-52513 affects various versions of the Linux kernel, specifically versions prior to 5.4.258, 5.10.198, 5.15.135, 6.1.57, 6.5.7, and 6.6.
What type of vulnerability is CVE-2023-52513?
CVE-2023-52513 is categorized as a connection handling vulnerability within the Linux kernel related to RDMA/siw.
When was CVE-2023-52513 discovered?
CVE-2023-52513 was publicly disclosed in October 2023 following the identification and resolution of the issue in the Linux kernel.