CVE-2023-53083

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: don't replace page in rq_pages if it's a continuation of last page

The splice read calls nfsd_splice_actor to put the pages containing file

data into the svc_rqst->rq_pages array. It's possible however to get a

splice result that only has a partial page at the end, if (e.g.) the

filesystem hands back a short read that doesn't cover the whole page.

nfsd_splice_actor will plop the partial page into its rq_pages array and

return. Then later, when nfsd_splice_actor is called again, the

remainder of the page may end up being filled out. At this point,

nfsd_splice_actor will put the page into the array _again_ corrupting

the reply. If this is done enough times, rq_next_page will overrun the

array and corrupt the trailing fields -- the rq_respages and

rq_next_page pointers themselves.

If we've already added the page to the array in the last pass, don't add

it to the array a second time when dealing with a splice con

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References