#VU108510 Improper resource shutdown or release in Linux kernel - CVE-2023-53072
Published: May 4, 2025 / Updated: May 10, 2025
Vulnerability identifier: #VU108510
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2023-53072
CWE-ID: CWE-404
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Linux kernel
Linux kernel
Software vendor:
Linux Foundation
Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to failure to properly release resources within the subflow_hmac_valid(), subflow_ulp_fallback(), mptcp_subflow_queue_clean() and subflow_ulp_release() functions in net/mptcp/subflow.c, within the __mptcp_close_ssk(), mptcp_sync_mss(), __mptcp_close_subflow(), mptcp_worker(), mptcp_sk_clone(), mptcp_accept() and mptcp_stream_accept() functions in net/mptcp/protocol.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
External links
- https://git.kernel.org/stable/c/2827f099b3fb9a59263c997400e9182f5d423e84
- https://git.kernel.org/stable/c/804cf487fb0031f3c74755b78d8663333f0ba636
- https://git.kernel.org/stable/c/b6985b9b82954caa53f862d6059d06c0526254f0
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.22
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.8
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3