{"id":"CVE-2023-52983","state":"PUBLISHED","title":"block, bfq: fix uaf for bfqq in bic_set_bfqq()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock, bfq: fix uaf for bfqq in bic_set_bfqq()\n\nAfter commit 64dc8c732f5c (\"block, bfq: fix possible uaf for 'bfqq->bic'\"),\nbic->bfqq will be accessed in bic_set_bfqq(), however, in some context\nbic->bfqq will be freed, and bic_set_bfqq() is called with the freed\nbic->bfqq.\n\nFix the problem by always freeing bfqq after bic_set_bfqq().","publishedAt":"2025-03-27T16:43:21.372Z","updatedAt":"2026-08-05T09:12:15.408Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5533742c7cb1bc9b1f0bf401cc397d44a3a9e07a","status":"affected","lessThan":"7f77f3dab5066a7c9da73d72d1eee895ff84a8d5","versionType":"git"},{"version":"094f3d9314d67691cb21ba091c1b528f6e3c4893","status":"affected","lessThan":"511c922c5bf6c8a166bea826e702336bc2424140","versionType":"git"},{"version":"761564d93c8265f65543acf0a576b32d66bfa26a","status":"affected","lessThan":"cb1876fc33af26d00efdd473311f1b664c77c44e","versionType":"git"},{"version":"64dc8c732f5c2b406cc752e6aaa1bd5471159cab","status":"affected","lessThan":"b600de2d7d3a16f9007fad1bdae82a3951a26af2","versionType":"git"},{"version":"b22fd72bfebda3956efc4431b60ddfc0a51e03e0","status":"affected","versionType":"git"},{"version":"6.0.16","status":"affected","lessThan":"6.1","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["block/bfq-cgroup.c","block/bfq-iosched.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5.15.86","status":"affected","lessThan":"5.15.93","versionType":"semver"},{"version":"6.1.2","status":"affected","lessThan":"6.1.11","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["block/bfq-cgroup.c","block/bfq-iosched.c"]}],"references":["https://git.kernel.org/stable/c/7f77f3dab5066a7c9da73d72d1eee895ff84a8d5","https://git.kernel.org/stable/c/511c922c5bf6c8a166bea826e702336bc2424140","https://git.kernel.org/stable/c/cb1876fc33af26d00efdd473311f1b664c77c44e","https://git.kernel.org/stable/c/b600de2d7d3a16f9007fad1bdae82a3951a26af2"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/52xxx/CVE-2023-52983.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-52983","state":"PUBLISHED","datePublished":"2025-03-27T16:43:21.372Z","dateUpdated":"2026-08-05T09:12:15.408Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-03-27T16:40:15.740Z"},"containers":{"cna":{"title":"block, bfq: fix uaf for bfqq in bic_set_bfqq()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock, bfq: fix uaf for bfqq in bic_set_bfqq()\n\nAfter commit 64dc8c732f5c (\"block, bfq: fix possible uaf for 'bfqq->bic'\"),\nbic->bfqq will be accessed in bic_set_bfqq(), however, in some context\nbic->bfqq will be freed, and bic_set_bfqq() is called with the freed\nbic->bfqq.\n\nFix the problem by always freeing bfqq after bic_set_bfqq()."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5533742c7cb1bc9b1f0bf401cc397d44a3a9e07a","status":"affected","lessThan":"7f77f3dab5066a7c9da73d72d1eee895ff84a8d5","versionType":"git"},{"version":"094f3d9314d67691cb21ba091c1b528f6e3c4893","status":"affected","lessThan":"511c922c5bf6c8a166bea826e702336bc2424140","versionType":"git"},{"version":"761564d93c8265f65543acf0a576b32d66bfa26a","status":"affected","lessThan":"cb1876fc33af26d00efdd473311f1b664c77c44e","versionType":"git"},{"version":"64dc8c732f5c2b406cc752e6aaa1bd5471159cab","status":"affected","lessThan":"b600de2d7d3a16f9007fad1bdae82a3951a26af2","versionType":"git"},{"version":"b22fd72bfebda3956efc4431b60ddfc0a51e03e0","status":"affected","versionType":"git"},{"version":"6.0.16","status":"affected","lessThan":"6.1","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["block/bfq-cgroup.c","block/bfq-iosched.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"5.15.86","status":"affected","lessThan":"5.15.93","versionType":"semver"},{"version":"6.1.2","status":"affected","lessThan":"6.1.11","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["block/bfq-cgroup.c","block/bfq-iosched.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/7f77f3dab5066a7c9da73d72d1eee895ff84a8d5"},{"url":"https://git.kernel.org/stable/c/511c922c5bf6c8a166bea826e702336bc2424140"},{"url":"https://git.kernel.org/stable/c/cb1876fc33af26d00efdd473311f1b664c77c44e"},{"url":"https://git.kernel.org/stable/c/b600de2d7d3a16f9007fad1bdae82a3951a26af2"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is reached through local block I/O submission (read/write/io_uring) into BFQ’s `bfq_init_rq()` path, not via network packet processing or a remote service.\nAC:L - An attacker can reliably set up merged BFQ queues via cooperating local I/O, then trigger the free-before-use ordering in `__bfq_bic_change_cgroup()`/`bfq_check_ioprio_change()`; success does not depend on a race or state outside attacker control.\nPR:L - Triggering requires only an unprivileged local process able to perform I/O (and change its own BE/IDLE ioprio or move within a delegated cgroup hierarchy); no real root/init-namespace CAP_SYS_ADMIN is required.\nUI:N - The attacker performs all I/O, ioprio, and cgroup actions themselves; no separate victim action is required.\nS:U - Impact is confined to the local kernel’s privilege boundary (standard local privilege escalation), with no VM/IOMMU/sandbox escape.\nC:H - Use-after-free of a slab-allocated `bfq_queue` enables control over freed object contents and arbitrary kernel information disclosure per UAF exploitation primitives.\nI:H - `bic_set_bfqq()` writes through the dangling `old_bfqq` pointer (nulling `bic`), giving a heap UAF write primitive exploitable for corruption and control-flow hijacking.\nA:H - The UAF can crash the kernel (oops/panic) even when not fully exploited, producing a full availability impact."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T09:12:15.408Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.86","versionEndExcluding":"5.15.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.2","versionEndExcluding":"6.1.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.16"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2023-52983","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-03-27T16:59:42.552227Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","type":"CWE","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-27T17:08:22.246Z"}}]}}}