CVE-2023-53836: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-hvcx-h3h8-m36g
Share
CVSS 7.8
Published
Advisory Summary

CVE-2023-53836 is a HIGH (CVSS 7.8) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2023-53836 at a Glance

CVE Identifier CVE-2023-53836
GHSA Identifier GHSA-hvcx-h3h8-m36g
Severity HIGH
CVSS v3.1 Base Score 7.8
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 7.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2023-53836

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2023-53836, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skb refcnt race after locking changes There is a race where skb's from the sk_psock_backlog can be referenced after userspace side has already skb_consumed() the sk_buff and its refcnt dropped to zer0 causing use after free. The flow is the following: while ((skb = skb_peek(&psock->ingress_skb)) sk_psock_handle_Skb(psock, skb, ..., ingress) if (!ingress) ... sk_psock_skb_ingress sk_psock_skb_ingress_enqueue(skb) msg->skb = skb sk_psock_queue_msg(psock, msg) skb_dequeue(&psock->ingress_skb) The sk_psock_queue_msg() puts the msg on the ingress_msg queue. This is what the application reads when recvmsg() is called. An application can read this anytime after the msg is placed on the queue. The recvmsg hook will also read msg->skb and then after user space reads the msg will call consume_skb(skb) on it effectively free'ing it. But, the race is in above where backlog queue still has a reference to the skb and calls skb_dequeue(). If the skb_dequeue happens after the user reads and free's the skb we have a use after free. The !ingress case does not suffer from this problem because it uses sendmsg_*(sk, msg) which does not pass the sk_buff further down the stack. The following splat was observed with 'test_progs -t sockmap_listen': [ 1022.710250][ T2556] general protection fault, ... [...] [ 1022.712830][ T2556] Workqueue: events sk_psock_backlog [ 1022.713262][ T2556] RIP: 0010:skb_dequeue+0x4c/0x80 [ 1022.713653][ T2556] Code: ... [...] [ 1022.720699][ T2556] Call Trace: [ 1022.720984][ T2556] <TASK> [ 1022.721254][ T2556] ? die_addr+0x32/0x80^M [ 1022.721589][ T2556] ? exc_general_protection+0x25a/0x4b0 [ 1022.722026][ T2556] ? asm_exc_general_protection+0x22/0x30 [ 1022.722489][ T2556] ? skb_dequeue+0x4c/0x80 [ 1022.722854][ T2556] sk_psock_backlog+0x27a/0x300 [ 1022.723243][ T2556] process_one_work+0x2a7/0x5b0 [ 1022.723633][ T2556] worker_thread+0x4f/0x3a0 [ 1022.723998][ T2556] ? __pfx_worker_thread+0x10/0x10 [ 1022.724386][ T2556] kthread+0xfd/0x130 [ 1022.724709][ T2556] ? __pfx_kthread+0x10/0x10 [ 1022.725066][ T2556] ret_from_fork+0x2d/0x50 [ 1022.725409][ T2556] ? __pfx_kthread+0x10/0x10 [ 1022.725799][ T2556] ret_from_fork_asm+0x1b/0x30 [ 1022.726201][ T2556] </TASK> To fix we add an skb_get() before passing the skb to be enqueued in the engress queue. This bumps the skb->users refcnt so that consume_skb() and kfree_skb will not immediately free the sk_buff. With this we can be sure the skb is still around when we do the dequeue. Then we just need to decrement the refcnt or free the skb in the backlog case which we do by calling kfree_skb() on the ingress case as well as the sendmsg case. Before locking change from fixes tag we had the sock locked so we couldn't race with user and there was no issue here.

References

NVD — CVE-2023-53836 NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-53836
git.kernel.org/stable/c/65ad600b9b... WEB
https://git.kernel.org/stable/c/65ad600b9bde68d2d28709943ab00b51ca8f0a1d
git.kernel.org/stable/c/923877254f... WEB
https://git.kernel.org/stable/c/923877254f002ae87d441382bb1096d9e773d56d
git.kernel.org/stable/c/a454d84ee2... WEB
https://git.kernel.org/stable/c/a454d84ee20baf7bd7be90721b9821f73c7d23d9
git.kernel.org/stable/c/e6b5e47adb... WEB
https://git.kernel.org/stable/c/e6b5e47adb9166e732cdf7e6e034946e3f89f36d

Frequently Asked Questions

What is CVE-2023-53836?
CVE-2023-53836 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2023-53836?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2023-53836?
CVE-2023-53836 has a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2023-53836?
CVE-2023-53836 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2023-53836?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-hvcx-h3h8-m36g",
  "modified" : "2026-08-04T12:34:42Z",
  "published" : "2025-12-09T18:30:33Z",
  "aliases" : [ "CVE-2023-53836" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix skb refcnt race after locking changes\n\nThere is a race where skb's from the sk_psock_backlog can be referenced\nafter userspace side has already skb_consumed() the sk_buff and its refcnt\ndropped to zer0 causing use after free.\n\nThe flow is the following:\n\n  while ((skb = skb_peek(&psock->ingress_skb))\n    sk_psock_handle_Skb(psock, skb, ..., ingress)\n    if (!ingress) ...\n    sk_psock_skb_ingress\n       sk_psock_skb_ingress_enqueue(skb)\n          msg->skb = skb\n          sk_psock_queue_msg(psock, msg)\n    skb_dequeue(&psock->ingress_skb)\n\nThe sk_psock_queue_msg() puts the msg on the ingress_msg queue. This is\nwhat the application reads when recvmsg() is called. An application can\nread this anytime after the msg is placed on the queue. The recvmsg hook\nwill also read msg->skb and then after user space reads the msg will call\nconsume_skb(skb) on it effectively free'ing it.\n\nBut, the race is in above where backlog queue still has a reference to\nthe skb and calls skb_dequeue(). If the skb_dequeue happens after the\nuser reads and free's the skb we have a use after free.\n\nThe !ingress case does not suffer from this problem because it uses\nsendmsg_*(sk, msg) which does not pass the sk_buff further down the\nstack.\n\nThe following splat was observed with 'test_progs -t sockmap_listen':\n\n  [ 1022.710250][ T2556] general protection fault, ...\n  [...]\n  [ 1022.712830][ T2556] Workqueue: events sk_psock_backlog\n  [ 1022.713262][ T2556] RIP: 0010:skb_dequeue+0x4c/0x80\n  [ 1022.713653][ T2556] Code: ...\n  [...]\n  [ 1022.720699][ T2556] Call Trace:\n  [ 1022.720984][ T2556]  <TASK>\n  [ 1022.721254][ T2556]  ? die_addr+0x32/0x80^M\n  [ 1022.721589][ T2556]  ? exc_general_protection+0x25a/0x4b0\n  [ 1022.722026][ T2556]  ? asm_exc_general_protection+0x22/0x30\n  [ 1022.722489][ T2556]  ? skb_dequeue+0x4c/0x80\n  [ 1022.722854][ T2556]  sk_psock_backlog+0x27a/0x300\n  [ 1022.723243][ T2556]  process_one_work+0x2a7/0x5b0\n  [ 1022.723633][ T2556]  worker_thread+0x4f/0x3a0\n  [ 1022.723998][ T2556]  ? __pfx_worker_thread+0x10/0x10\n  [ 1022.724386][ T2556]  kthread+0xfd/0x130\n  [ 1022.724709][ T2556]  ? __pfx_kthread+0x10/0x10\n  [ 1022.725066][ T2556]  ret_from_fork+0x2d/0x50\n  [ 1022.725409][ T2556]  ? __pfx_kthread+0x10/0x10\n  [ 1022.725799][ T2556]  ret_from_fork_asm+0x1b/0x30\n  [ 1022.726201][ T2556]  </TASK>\n\nTo fix we add an skb_get() before passing the skb to be enqueued in the\nengress queue. This bumps the skb->users refcnt so that consume_skb()\nand kfree_skb will not immediately free the sk_buff. With this we can\nbe sure the skb is still around when we do the dequeue. Then we just\nneed to decrement the refcnt or free the skb in the backlog case which\nwe do by calling kfree_skb() on the ingress case as well as the sendmsg\ncase.\n\nBefore locking change from fixes tag we had the sock locked so we\ncouldn't race with user and there was no issue here.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-53836"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/65ad600b9bde68d2d28709943ab00b51ca8f0a1d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/923877254f002ae87d441382bb1096d9e773d56d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a454d84ee20baf7bd7be90721b9821f73c7d23d9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e6b5e47adb9166e732cdf7e6e034946e3f89f36d"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2025-12-09T16:17:22Z"
  }
}