DEBIAN-CVE-2023-53345

Source
https://security-tracker.debian.org/tracker/CVE-2023-53345
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53345.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2023-53345
Upstream
Published
2025-09-17T15:15:38.363Z
Modified
2025-12-11T11:15:17.272475Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential data race in rxrpcwaittobeconnected() Inside the loop in rxrpcwaittobeconnected() it checks call->error to see if it should exit the loop without first checking the call state. This is probably safe as if call->error is set, the call is dead anyway, but we should probably wait for the call state to have been set to completion first, lest it cause surprise on the way out. Fix this by only accessing call->error if the call is complete. We don't actually need to access the error inside the loop as we'll do that after. This caused the following report: BUG: KCSAN: data-race in rxrpcsenddata / rxrpcsetcallcompletion write to 0xffff888159cf3c50 of 4 bytes by task 25673 on cpu 1: rxrpcsetcallcompletion+0x71/0x1c0 net/rxrpc/callstate.c:22 rxrpcsenddatapacket+0xba9/0x1650 net/rxrpc/output.c:479 rxrpctransmitone+0x1e/0x130 net/rxrpc/output.c:714 rxrpcdecantpreparedtx net/rxrpc/callevent.c:326 [inline] rxrpctransmitsomedata+0x496/0x600 net/rxrpc/callevent.c:350 rxrpcinputcallevent+0x564/0x1220 net/rxrpc/callevent.c:464 rxrpciothread+0x307/0x1d80 net/rxrpc/iothread.c:461 kthread+0x1ac/0x1e0 kernel/kthread.c:376 retfromfork+0x1f/0x30 arch/x86/entry/entry64.S:308 read to 0xffff888159cf3c50 of 4 bytes by task 25672 on cpu 0: rxrpcsenddata+0x29e/0x1950 net/rxrpc/sendmsg.c:296 rxrpcdosendmsg+0xb7a/0xc20 net/rxrpc/sendmsg.c:726 rxrpcsendmsg+0x413/0x520 net/rxrpc/afrxrpc.c:565 socksendmsgnosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0x375/0x4c0 net/socket.c:2501 ___sys_sendmsg net/socket.c:2555 [inline] __sys_sendmmsg+0x263/0x500 net/socket.c:2641 __dosyssendmmsg net/socket.c:2670 [inline] __sesyssendmmsg net/socket.c:2667 [inline] __x64syssendmmsg+0x57/0x60 net/socket.c:2667 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x41/0xc0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x63/0xcd value changed: 0x00000000 -> 0xffffffea

References

Affected packages

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.3.7-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53345.json"

Debian:14 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.3.7-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53345.json"