CVE-2023-53469 Details

A null pointer dereference vulnerability has been identified in the Linux kernel's Unix stream sendpage function, specifically in versions prior to 6.5. This vulnerability arises because the function attempts to add data to the last socket buffer in the peer's receive queue without properly locking the queue. This creates a race condition where the function could access a socket buffer that is being released by the garbage collection process, leading to a use-after-free scenario. The issue can occur if the peer's file descriptor is passed to another socket, creating a loop between them, and both sockets are closed without transferring the file descriptor back, allowing the garbage collector to unlink the socket buffer from the receive queue under lock, while the sendpage function accesses it locklessly.

Users can upgrade to Linux kernel version 6.5 or later, where this vulnerability has been addressed.