CVE-2023-52618

What it actually does

Potential truncation when concatenating dev_search_path (up to PATH_MAX) and dev_name into a PATH_MAX-sized full_path buffer via snprintf in rnbd_srv_get_full_path, allowing malformed paths or unexpected behavior on long inputs.

Why it matters to the business

Minimal operational risk to Linux systems using the rnbd block device driver over RDMA; no known exploitation or ransomware use after 942 days, with very low EPSS and limited ecosystem prevalence outside specialized storage setups.

How an attack unfolds

An attacker controlling dev_search_path or dev_name values passed to process_msg_open would attempt to supply oversized strings to cause snprintf truncation, resulting in an incomplete full_path and possible failure or misbehavior when opening remote devices; no named threat actors have been observed exploiting it.

How to fix it

Upgrade the Linux kernel to a fixed version containing commit 95bc866c11974d3e4a9d922275ea8127ff809cf7 or later; apply the unconditional truncation check in rnbd_srv_get_full_path and rebuild.

How to confirm the fix worked

Verify the presence of the truncation check after snprintf in drivers/block/rnbd/rnbd-srv.c and confirm the running kernel includes commit 95bc866c11974d3e4a9d922275ea8127ff809cf7 or equivalent distribution patch.

Typical attack path

1. Locate systems running vulnerable Linux kernels with rnbd-srv enabled
2. Supply an oversized dev_search_path or dev_name via the rnbd protocol message
3. Observe truncation or path handling side effects during device open

How to detect it

Review kernel logs and audit trails for rnbd path construction errors or unexpected device open failures; no public indicators of active exploitation exist.

What your security team should do

• Prioritize kernel updates on any systems exposing rnbd server functionality
• Monitor EPSS and KEV status for changes given the 942-day publication age
• Audit custom or downstream kernels for the same snprintf pattern