{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-52636","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-03-06T09:52:12.093Z","datePublished":"2024-04-02T07:01:38.187Z","dateUpdated":"2026-08-05T09:10:48.688Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T09:10:48.688Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: just wait for more data to be available on the socket\n\nA short read may occur while reading the message footer from the\nsocket.  Later, when the socket is ready for another read, the\nmessenger invokes all read_partial_*() handlers, including\nread_partial_sparse_msg_data().  The expectation is that\nread_partial_sparse_msg_data() would bail, allowing the messenger to\ninvoke read_partial() for the footer and pick up where it left off.\n\nHowever read_partial_sparse_msg_data() violates that and ends up\ncalling into the state machine in the OSD client.  The sparse-read\nstate machine assumes that it's a new op and interprets some piece of\nthe footer as the sparse-read header and returns bogus extents/data\nlength, etc.\n\nTo determine whether read_partial_sparse_msg_data() should bail, let's\nreuse cursor->total_resid.  Because once it reaches to zero that means\nall the extents and data have been successfully received in last read,\nelse it could break out when partially reading any of the extents and\ndata.  And then osd_sparse_read() could continue where it left off.\n\n[ idryomov: changelog ]"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable path is in libceph's msgr1 TCP receive handler processing sparse-read replies from a remote Ceph OSD peer; a malicious or compromised OSD can deliver the triggering message over the network.\nAC:L - An attacking OSD fully controls response content and TCP segmentation, so it can reliably force a short read exactly after sparse payload completion and supply footer bytes that the state machine misinterprets.\nPR:N - Exploitation requires no privileges on the victim host; the attacker acts as a remote OSD peer already speaking the Ceph protocol to the client, analogous to other malicious-server client parser bugs.\nUI:N - Once CephFS is mounted with sparse reads in use (encrypted inodes or sparseread), ordinary client I/O drives the vulnerable receive path without further user action.\nS:U - Impact is confined to the local kernel Ceph client; there is no VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:N - The bug misparses on-wire footer/extent metadata and may overwrite the intended read buffer or fault the connection, but it does not disclose kernel memory or provide an arbitrary read primitive.\nI:L - Re-entering the sparse-read machine can re-initialize the cursor and write misparsed footer/stream bytes into the in-progress page-cache read buffer, corrupting that data in a limited, buffer-bounded way rather than enabling arbitrary kernel writes.\nA:H - Misparsed extent counts drive huge allocations (observed ~2.2B extents), connection faults, allocator WARNs, and cursor overruns that hit BUG_ON, denying Ceph I/O and potentially crashing the kernel."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/ceph/messenger.h","net/ceph/messenger_v1.c","net/ceph/messenger_v2.c","net/ceph/osd_client.c"],"versions":[{"version":"d396f89db39a2f259e2125ca43b4c31bb65afcad","lessThan":"da9c33a70f095d5d55c36d0bfeba969e31de08ae","status":"affected","versionType":"git"},{"version":"d396f89db39a2f259e2125ca43b4c31bb65afcad","lessThan":"bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8","status":"affected","versionType":"git"},{"version":"d396f89db39a2f259e2125ca43b4c31bb65afcad","lessThan":"8e46a2d068c92a905d01cbb018b00d66991585ab","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/ceph/messenger.h","net/ceph/messenger_v1.c","net/ceph/messenger_v2.c","net/ceph/osd_client.c"],"versions":[{"version":"6.6","status":"affected"},{"version":"0","lessThan":"6.6","status":"unaffected","versionType":"semver"},{"version":"6.6.17","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.5","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.6.17"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.7.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6","versionEndExcluding":"6.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae"},{"url":"https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8"},{"url":"https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab"}],"title":"libceph: just wait for more data to be available on the socket","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T23:03:21.209Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab","tags":["x_transferred"]}]},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2023-52636","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T15:53:29.480667Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-11T17:33:37.157Z"}}]}}