CVE-2023-52636 (GCVE-0-2023-52636)

Vulnerability from cvelistv5 – Published: 2024-04-02 07:01 – Updated: 2026-08-05 09:10
VLAI
Title
libceph: just wait for more data to be available on the socket
Summary
In the Linux kernel, the following vulnerability has been resolved: libceph: just wait for more data to be available on the socket A short read may occur while reading the message footer from the socket. Later, when the socket is ready for another read, the messenger invokes all read_partial_*() handlers, including read_partial_sparse_msg_data(). The expectation is that read_partial_sparse_msg_data() would bail, allowing the messenger to invoke read_partial() for the footer and pick up where it left off. However read_partial_sparse_msg_data() violates that and ends up calling into the state machine in the OSD client. The sparse-read state machine assumes that it's a new op and interprets some piece of the footer as the sparse-read header and returns bogus extents/data length, etc. To determine whether read_partial_sparse_msg_data() should bail, let's reuse cursor->total_resid. Because once it reaches to zero that means all the extents and data have been successfully received in last read, else it could break out when partially reading any of the extents and data. And then osd_sparse_read() could continue where it left off. [ idryomov: changelog ]
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:53 UTC
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d396f89db39a2f259e2125ca43b4c31bb65afcad , < da9c33a70f095d5d55c36d0bfeba969e31de08ae (git)
Affected: d396f89db39a2f259e2125ca43b4c31bb65afcad , < bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8 (git)
Affected: d396f89db39a2f259e2125ca43b4c31bb65afcad , < 8e46a2d068c92a905d01cbb018b00d66991585ab (git)
Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.17 , ≤ 6.6.* (semver)
Unaffected: 6.7.5 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:21.209Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52636",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:53:29.480667Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:37.157Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/ceph/messenger.h",
            "net/ceph/messenger_v1.c",
            "net/ceph/messenger_v2.c",
            "net/ceph/osd_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "da9c33a70f095d5d55c36d0bfeba969e31de08ae",
              "status": "affected",
              "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad",
              "versionType": "git"
            },
            {
              "lessThan": "bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8",
              "status": "affected",
              "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad",
              "versionType": "git"
            },
            {
              "lessThan": "8e46a2d068c92a905d01cbb018b00d66991585ab",
              "status": "affected",
              "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/ceph/messenger.h",
            "net/ceph/messenger_v1.c",
            "net/ceph/messenger_v2.c",
            "net/ceph/osd_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.17",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.5",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: just wait for more data to be available on the socket\n\nA short read may occur while reading the message footer from the\nsocket.  Later, when the socket is ready for another read, the\nmessenger invokes all read_partial_*() handlers, including\nread_partial_sparse_msg_data().  The expectation is that\nread_partial_sparse_msg_data() would bail, allowing the messenger to\ninvoke read_partial() for the footer and pick up where it left off.\n\nHowever read_partial_sparse_msg_data() violates that and ends up\ncalling into the state machine in the OSD client.  The sparse-read\nstate machine assumes that it\u0027s a new op and interprets some piece of\nthe footer as the sparse-read header and returns bogus extents/data\nlength, etc.\n\nTo determine whether read_partial_sparse_msg_data() should bail, let\u0027s\nreuse cursor-\u003etotal_resid.  Because once it reaches to zero that means\nall the extents and data have been successfully received in last read,\nelse it could break out when partially reading any of the extents and\ndata.  And then osd_sparse_read() could continue where it left off.\n\n[ idryomov: changelog ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is in libceph\u0027s msgr1 TCP receive handler processing sparse-read replies from a remote Ceph OSD peer; a malicious or compromised OSD can deliver the triggering message over the network.\nAC:L - An attacking OSD fully controls response content and TCP segmentation, so it can reliably force a short read exactly after sparse payload completion and supply footer bytes that the state machine misinterprets.\nPR:N - Exploitation requires no privileges on the victim host; the attacker acts as a remote OSD peer already speaking the Ceph protocol to the client, analogous to other malicious-server client parser bugs.\nUI:N - Once CephFS is mounted with sparse reads in use (encrypted inodes or sparseread), ordinary client I/O drives the vulnerable receive path without further user action.\nS:U - Impact is confined to the local kernel Ceph client; there is no VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:N - The bug misparses on-wire footer/extent metadata and may overwrite the intended read buffer or fault the connection, but it does not disclose kernel memory or provide an arbitrary read primitive.\nI:L - Re-entering the sparse-read machine can re-initialize the cursor and write misparsed footer/stream bytes into the in-progress page-cache read buffer, corrupting that data in a limited, buffer-bounded way rather than enabling arbitrary kernel writes.\nA:H - Misparsed extent counts drive huge allocations (observed ~2.2B extents), connection faults, allocator WARNs, and cursor overruns that hit BUG_ON, denying Ceph I/O and potentially crashing the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:10:48.688Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab"
        }
      ],
      "title": "libceph: just wait for more data to be available on the socket",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52636",
    "datePublished": "2024-04-02T07:01:38.187Z",
    "dateReserved": "2024-03-06T09:52:12.093Z",
    "dateUpdated": "2026-08-05T09:10:48.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52636",
      "date": "2026-10-02",
      "epss": "0.00515",
      "percentile": "0.41738"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/ceph/messenger.h",
                  "net/ceph/messenger_v1.c",
                  "net/ceph/messenger_v2.c",
                  "net/ceph/osd_client.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "da9c33a70f095d5d55c36d0bfeba969e31de08ae",
                    "status": "affected",
                    "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8",
                    "status": "affected",
                    "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8e46a2d068c92a905d01cbb018b00d66991585ab",
                    "status": "affected",
                    "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/ceph/messenger.h",
                  "net/ceph/messenger_v1.c",
                  "net/ceph/messenger_v2.c",
                  "net/ceph/osd_client.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.17",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.7.*",
                    "status": "unaffected",
                    "version": "6.7.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.8",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0B77B682-A9FE-43C2-9370-B5523C080B80",
                    "versionEndExcluding": "6.6.17",
                    "versionStartIncluding": "6.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "01925741-2C95-47C1-A7EA-3DC2BB0012D3",
                    "versionEndExcluding": "6.7.5",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B9F4EA73-0894-400F-A490-3A397AB7A517",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "056BD938-0A27-4569-B391-30578B309EE3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: just wait for more data to be available on the socket\n\nA short read may occur while reading the message footer from the\nsocket.  Later, when the socket is ready for another read, the\nmessenger invokes all read_partial_*() handlers, including\nread_partial_sparse_msg_data().  The expectation is that\nread_partial_sparse_msg_data() would bail, allowing the messenger to\ninvoke read_partial() for the footer and pick up where it left off.\n\nHowever read_partial_sparse_msg_data() violates that and ends up\ncalling into the state machine in the OSD client.  The sparse-read\nstate machine assumes that it\u0027s a new op and interprets some piece of\nthe footer as the sparse-read header and returns bogus extents/data\nlength, etc.\n\nTo determine whether read_partial_sparse_msg_data() should bail, let\u0027s\nreuse cursor-\u003etotal_resid.  Because once it reaches to zero that means\nall the extents and data have been successfully received in last read,\nelse it could break out when partially reading any of the extents and\ndata.  And then osd_sparse_read() could continue where it left off.\n\n[ idryomov: changelog ]"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: \"libceph: just wait for more data to be available on the socket\". Puede ocurrir una lectura breve mientras se lee el pie de p\u00e1gina del mensaje desde el socket. M\u00e1s tarde, cuando el socket est\u00e1 listo para otra lectura, el mensajero invoca todos los controladores read_partial_*(), incluido read_partial_sparse_msg_data(). La expectativa es que read_partial_sparse_msg_data() saldr\u00eda, permitiendo al mensajero invocar read_partial() para el pie de p\u00e1gina y continuar donde lo dej\u00f3. Sin embargo, read_partial_sparse_msg_data() viola eso y termina llamando a la m\u00e1quina de estado en el cliente OSD. La m\u00e1quina de estado de lectura dispersa asume que es una nueva operaci\u00f3n e interpreta alguna parte del pie de p\u00e1gina como el encabezado de lectura dispersa y devuelve extensiones/longitud de datos falsas, etc. Para determinar si read_partial_sparse_msg_data() debe rescatarse, reutilicemos cursor-\u0026gt;total_resid . Porque una vez que llega a cero, significa que todas las extensiones y datos se recibieron correctamente en la \u00faltima lectura; de lo contrario, podr\u00eda romperse al leer parcialmente cualquiera de las extensiones y datos. Y luego osd_sparse_read() podr\u00eda continuar donde lo dej\u00f3. [idryomov: registro de cambios]"
          }
        ],
        "id": "CVE-2023-52636",
        "lastModified": "2026-08-04T10:18:35.880",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-52636",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:53:29.480667Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-02T07:15:41.337",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:56:52+00:00",
      "cve": "CVE-2023-52636",
      "id": "CVE-2023-52636",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: libceph: just wait for more data to be available on the socket",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52636.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T23:03:21.209Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-52636",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T15:53:29.480667Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:17.655Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "include/linux/ceph/messenger.h",
                "net/ceph/messenger_v1.c",
                "net/ceph/messenger_v2.c",
                "net/ceph/osd_client.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "da9c33a70f095d5d55c36d0bfeba969e31de08ae",
                  "status": "affected",
                  "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad",
                  "versionType": "git"
                },
                {
                  "lessThan": "bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8",
                  "status": "affected",
                  "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad",
                  "versionType": "git"
                },
                {
                  "lessThan": "8e46a2d068c92a905d01cbb018b00d66991585ab",
                  "status": "affected",
                  "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "include/linux/ceph/messenger.h",
                "net/ceph/messenger_v1.c",
                "net/ceph/messenger_v2.c",
                "net/ceph/osd_client.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.6"
                },
                {
                  "lessThan": "6.6",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.17",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.7.*",
                  "status": "unaffected",
                  "version": "6.7.5",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.8",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.17",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.7.5",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: just wait for more data to be available on the socket\n\nA short read may occur while reading the message footer from the\nsocket.  Later, when the socket is ready for another read, the\nmessenger invokes all read_partial_*() handlers, including\nread_partial_sparse_msg_data().  The expectation is that\nread_partial_sparse_msg_data() would bail, allowing the messenger to\ninvoke read_partial() for the footer and pick up where it left off.\n\nHowever read_partial_sparse_msg_data() violates that and ends up\ncalling into the state machine in the OSD client.  The sparse-read\nstate machine assumes that it\u0027s a new op and interprets some piece of\nthe footer as the sparse-read header and returns bogus extents/data\nlength, etc.\n\nTo determine whether read_partial_sparse_msg_data() should bail, let\u0027s\nreuse cursor-\u003etotal_resid.  Because once it reaches to zero that means\nall the extents and data have been successfully received in last read,\nelse it could break out when partially reading any of the extents and\ndata.  And then osd_sparse_read() could continue where it left off.\n\n[ idryomov: changelog ]"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:N - The vulnerable path is in libceph\u0027s msgr1 TCP receive handler processing sparse-read replies from a remote Ceph OSD peer; a malicious or compromised OSD can deliver the triggering message over the network.\nAC:L - An attacking OSD fully controls response content and TCP segmentation, so it can reliably force a short read exactly after sparse payload completion and supply footer bytes that the state machine misinterprets.\nPR:N - Exploitation requires no privileges on the victim host; the attacker acts as a remote OSD peer already speaking the Ceph protocol to the client, analogous to other malicious-server client parser bugs.\nUI:N - Once CephFS is mounted with sparse reads in use (encrypted inodes or sparseread), ordinary client I/O drives the vulnerable receive path without further user action.\nS:U - Impact is confined to the local kernel Ceph client; there is no VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:N - The bug misparses on-wire footer/extent metadata and may overwrite the intended read buffer or fault the connection, but it does not disclose kernel memory or provide an arbitrary read primitive.\nI:L - Re-entering the sparse-read machine can re-initialize the cursor and write misparsed footer/stream bytes into the in-progress page-cache read buffer, corrupting that data in a limited, buffer-bounded way rather than enabling arbitrary kernel writes.\nA:H - Misparsed extent counts drive huge allocations (observed ~2.2B extents), connection faults, allocator WARNs, and cursor overruns that hit BUG_ON, denying Ceph I/O and potentially crashing the kernel."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T09:10:48.688Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae"
            },
            {
              "url": "https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8"
            },
            {
              "url": "https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab"
            }
          ],
          "title": "libceph: just wait for more data to be available on the socket",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2023-52636",
        "datePublished": "2024-04-02T07:01:38.187Z",
        "dateReserved": "2024-03-06T09:52:12.093Z",
        "dateUpdated": "2026-08-05T09:10:48.688Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.