CVE-2023-52583 json
ceph: fix deadlock or deadcode of misusing dget()
published 2024-03-06 2 y ago modified 2026-08-15 2 mo ago also EUVD-2023-57207
- cvss
- 5.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 7%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix deadlock or deadcode of misusing dget()
The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first.
But since this deadcode is never used and the parent dir will always be set from the callers, let's just remove it.
Patch / fix
- Linux Linux 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, 6.8
- linux Debian 12 6.1.82-1
- linux Debian 14, Debian 13 6.7.7-1
debian advisories DEBIAN-CVE-2023-52583
- linux Ubuntu 20.04 LTS 5.4.0-181.201
- linux Ubuntu 22.04 LTS 5.15.0-106.116
- linux-aws Ubuntu 20.04 LTS 5.4.0-1124.134
- linux-aws Ubuntu 22.04 LTS 5.15.0-1061.67
- linux-gcp Ubuntu 20.04 LTS 5.4.0-1128.137
- linux-gcp Ubuntu 22.04 LTS 5.15.0-1059.67
- linux-gke Ubuntu 22.04 LTS 5.15.0-1058.63
- linux-ibm Ubuntu 20.04 LTS 5.4.0-1071.76
ubuntu advisories UBUNTU-CVE-2023-52583
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kernel-syms SLES for SAP 12 SP5, SLES 12 SP5 4.12.14-122.216.1
- kernel-source SLES for SAP 12 SP5, SLES 12 SP5 4.12.14-122.216.1
- kernel-default SLES for SAP 12 SP5, SLES 12 SP5, SLE Workstation Extension 12 SP5 +2 more 4.12.14-122.216.1
- kernel-obs-build SLE Software Development Kit 12 SP5 4.12.14-122.216.1
- kernel-rt SLE Real Time 12 SP5 4.12.14-10.182.1
- kernel-syms-rt SLE Real Time 12 SP5 4.12.14-10.182.1
- kernel-rt_debug SLE Real Time 12 SP5 4.12.14-10.182.1
- kernel-source-rt SLE Real Time 12 SP5 4.12.14-10.182.1
suse advisories SUSE-SU-2024:1870-1SUSE-SU-2024:1646-1SUSE-SU-2024:1643-1SUSE-SU-2024:1490-1SUSE-SU-2024:1489-1SUSE-SU-2024:1480-1
- git.kernel.org/stable/c/eb55ba8aa7fb7aad54f40fbf4d8dcdfdba0bebf6 commit
- git.kernel.org/stable/c/6ab4fd508fad942f1f1ba940492f2735e078e980 commit
- git.kernel.org/stable/c/e016e358461b89b231626fcf78c5c38e35c44fd3 commit
- git.kernel.org/stable/c/a9c15d6e8aee074fae66c04d114f20b84274fcca commit
- git.kernel.org/stable/c/7f2649c94264d00df6b6ac27161e9f4372a3450e commit
- git.kernel.org/stable/c/196b87e5c00ce021e164a5de0f0d04f4116a9160 commit
- git.kernel.org/stable/c/76cb2aa3421fee4fde706dec41b1344bc0a9ad67 commit
- git.kernel.org/stable/c/b493ad718b1f0357394d2cdecbf00a44a36fa085 commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
cisa ICSA-25-226-15 updated
Siemens SINEC OS
-
Siemens RUGGEDCOM RST2428P (6GK6242-6PA00) Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 familynot affected
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
red hat product security vex CVE-2023-52583 updated cvss 5.5
kernel: ceph: fix deadlock or deadcode of misusing dget()
-
Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 moreaffected: no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 moreaffected: no fix planned “Will not fix”
-
Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +82 moreaffected: no fix available “Fix deferred”
-
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Linux Linux
Classification
- Weakness
-
- CWE-667 Improper Locking
- Technology feeds
References
-
git.kernel.org
/stable/c/eb55ba8aa7fb7aad54f40fbf4d8dcdfdba0bebf6
patch
-
git.kernel.org
/stable/c/6ab4fd508fad942f1f1ba940492f2735e078e980
patch
-
git.kernel.org
/stable/c/e016e358461b89b231626fcf78c5c38e35c44fd3
patch
-
git.kernel.org
/stable/c/a9c15d6e8aee074fae66c04d114f20b84274fcca
patch
-
git.kernel.org
/stable/c/7f2649c94264d00df6b6ac27161e9f4372a3450e
patch
-
git.kernel.org
/stable/c/196b87e5c00ce021e164a5de0f0d04f4116a9160
patch
-
git.kernel.org
/stable/c/76cb2aa3421fee4fde706dec41b1344bc0a9ad67
patch
-
git.kernel.org
/stable/c/b493ad718b1f0357394d2cdecbf00a44a36fa085
patch
-
lists.debian.org
/debian-lts-announce/2024/06/msg00017.html
mailing-list
-
lists.debian.org
/debian-lts-announce/2024/06/msg00020.html
mailing-list
Sources
- CVE List CVE-2023-52583
- NVD CVE-2023-52583
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.