CVE-2023-52735

Source
https://cve.org/CVERecord?id=CVE-2023-52735
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52735.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-52735
Downstream
BELL (1)
CLSA (1)
DEBIAN (1)
OESA (1)
RHSA (3)
SUSE (12)
UBUNTU (1)
Related
Published
2024-05-21T15:22:59Z
Modified
2026-10-20T10:30:55Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVSS Calculator
Summary
bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself
Details

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself

sock_map proto callbacks should never call themselves by design. Protect against bugs like [1] and break out of the recursive loop to avoid a stack overflow in favor of a resource leak.

[1] https://lore.kernel.org/all/00000000000073b14905ef2e7401@google.com/

Database specific
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52735.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c5cc0d23c5414d23438c5024890e367cc5a0e645
Fixed
f312367f5246e04df564d341044286e9e37a97ba
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c5d2177a72a1659554922728fc407f59950aa929
Fixed
7499859881488da97589f3c79cc66fa75748ad49
Fixed
5b4a79ba65a1ab479903fff2e604865d229b70a9
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.15.3
Fixed
5.15.95
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.14.19
Fixed
5.15
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0580e47c8895a4d61ee095f086cba1ded7ca5e7f

Affected versions

v5.*
v5.14.19
v5.14.20
v5.14.21
v5.15.10
v5.15.11
v5.15.12
v5.15.13
v5.15.14
v5.15.15
v5.15.16
v5.15.17
v5.15.18
v5.15.19
v5.15.20
v5.15.21
v5.15.22
v5.15.23
v5.15.24
v5.15.25
v5.15.26
v5.15.27
v5.15.28
v5.15.29
v5.15.3
v5.15.30
v5.15.31
v5.15.32
v5.15.33
v5.15.34
v5.15.35
v5.15.36
v5.15.37
v5.15.38
v5.15.39
v5.15.4
v5.15.40
v5.15.41
v5.15.42
v5.15.43
v5.15.44
v5.15.45
v5.15.46
v5.15.47
v5.15.48
v5.15.49
v5.15.5
v5.15.50
v5.15.51
v5.15.52
v5.15.53
v5.15.54
v5.15.55
v5.15.56
v5.15.57
v5.15.58
v5.15.59
v5.15.6
v5.15.60
v5.15.61
v5.15.62
v5.15.63
v5.15.64
v5.15.65
v5.15.66
v5.15.67
v5.15.68
v5.15.69
v5.15.7
v5.15.70
v5.15.71
v5.15.72
v5.15.73
v5.15.74
v5.15.75
v5.15.76
v5.15.77
v5.15.78
v5.15.79
v5.15.8
v5.15.80
v5.15.81
v5.15.82
v5.15.83
v5.15.84
v5.15.85
v5.15.86
v5.15.87
v5.15.88
v5.15.89
v5.15.9
v5.15.90
v5.15.91
v5.15.92
v5.15.93
v5.15.94

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52735.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.15.95
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.13

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52735.json"