CVE - CVE-2023-53083

CVE-ID
CVE-2023-53083	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: don't replace page in rq_pages if it's a continuation of last page The splice read calls nfsd_splice_actor to put the pages containing file data into the svc_rqst->rq_pages array. It's possible however to get a splice result that only has a partial page at the end, if (e.g.) the filesystem hands back a short read that doesn't cover the whole page. nfsd_splice_actor will plop the partial page into its rq_pages array and return. Then later, when nfsd_splice_actor is called again, the remainder of the page may end up being filled out. At this point, nfsd_splice_actor will put the page into the array _again_ corrupting the reply. If this is done enough times, rq_next_page will overrun the array and corrupt the trailing fields -- the rq_respages and rq_next_page pointers themselves. If we've already added the page to the array in the last pass, don't add it to the array a second time when dealing with a splice continuation. This was originally handled properly in nfsd_splice_actor, but commit 91e23b1c3982 ("NFSD: Clean up nfsd_splice_actor()") removed the check for it.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/0101067f376eb7b9afd00279270f25d5111a091d URL:https://git.kernel.org/stable/c/0101067f376eb7b9afd00279270f25d5111a091d MISC:https://git.kernel.org/stable/c/12eca509234acb6b666802edf77408bb70d7bfca URL:https://git.kernel.org/stable/c/12eca509234acb6b666802edf77408bb70d7bfca MISC:https://git.kernel.org/stable/c/27c934dd8832dd40fd34776f916dc201e18b319b URL:https://git.kernel.org/stable/c/27c934dd8832dd40fd34776f916dc201e18b319b MISC:https://git.kernel.org/stable/c/51ddb84baff6f09ad62b5999ece3ec172e4e3568 URL:https://git.kernel.org/stable/c/51ddb84baff6f09ad62b5999ece3ec172e4e3568 MISC:https://git.kernel.org/stable/c/8235cd619db6e67f1d7d26c55f1f3e4e575c947d URL:https://git.kernel.org/stable/c/8235cd619db6e67f1d7d26c55f1f3e4e575c947d
Assigning CNA
kernel.org
Date Record Created
20250502	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250502)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)