CVE-2023-52502

net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()

State: Published
Severity: 8.8 High
Published: Mar 2, 2024
Updated: Aug 5, 2026
Reserved: Feb 20, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()

Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF.

Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock.

nfc_llcp_sock_get_sn() has a similar problem.

Finally nfc_llcp_recv_snl() needs to make sure the socket found by nfc_llcp_sock_from_sn() does not disappear.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	6.3 Medium	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8f50020ed9b81ba909ce9573f9d05263cdebf502 to before e863f5720a5680e50c4cecf12424d7cc31b3eb0aAffected 8f50020ed9b81ba909ce9573f9d05263cdebf502 to before 7adcf014bda16cdbf804af5c164d94d5d025db2dAffected 8f50020ed9b81ba909ce9573f9d05263cdebf502 to before 6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9Affected 8f50020ed9b81ba909ce9573f9d05263cdebf502 to before d888d3f70b0de32b4f51534175f039ddab15eef8Affected 8f50020ed9b81ba909ce9573f9d05263cdebf502 to before e4f2611f07c87b3ddb57c4b9e8efcd1e330fc3dcAffected 8f50020ed9b81ba909ce9573f9d05263cdebf502 to before d1af8a39cf839d93c8967fdd858f6bbdc3e4a15cAffected 8f50020ed9b81ba909ce9573f9d05263cdebf502 to before 31c07dffafce914c1d1543c135382a11ff058d93Affected
LinuxLinux	3.6Affected before 3.6Not affected 4.19.297 through 4.19.Not affected 5.4.259 through 5.4.Not affected 5.10.199 through 5.10.Not affected 5.15.136 through 5.15.Not affected 6.1.59 through 6.1.Not affected 6.5.8 through 6.5.Not affected 6.6 and laterNot affected

Product

Versions

LinuxLinux

8f50020ed9b81ba909ce9573f9d05263cdebf502 to before e863f5720a5680e50c4cecf12424d7cc31b3eb0aAffected
8f50020ed9b81ba909ce9573f9d05263cdebf502 to before 7adcf014bda16cdbf804af5c164d94d5d025db2dAffected
8f50020ed9b81ba909ce9573f9d05263cdebf502 to before 6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9Affected
8f50020ed9b81ba909ce9573f9d05263cdebf502 to before d888d3f70b0de32b4f51534175f039ddab15eef8Affected
8f50020ed9b81ba909ce9573f9d05263cdebf502 to before e4f2611f07c87b3ddb57c4b9e8efcd1e330fc3dcAffected
8f50020ed9b81ba909ce9573f9d05263cdebf502 to before d1af8a39cf839d93c8967fdd858f6bbdc3e4a15cAffected
8f50020ed9b81ba909ce9573f9d05263cdebf502 to before 31c07dffafce914c1d1543c135382a11ff058d93Affected

LinuxLinux

3.6Affected
before 3.6Not affected
4.19.297 through 4.19.*Not affected
5.4.259 through 5.4.*Not affected
5.10.199 through 5.10.*Not affected
5.15.136 through 5.15.*Not affected
6.1.59 through 6.1.*Not affected
6.5.8 through 6.5.*Not affected
6.6 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.