CVE-2023-52653

What it actually does

Memory leak of ctx->mech_used.data buffer allocated via kmemdup inside gss_import_v2_context that is never released on the error path or by its caller gss_krb5_import_sec_context.

Why it matters to the business

Long-running Linux systems using Kerberos-authenticated NFS or RPC services may experience gradual kernel memory exhaustion, leading to performance degradation or eventual denial of service.

How an attack unfolds

An attacker repeatedly triggers gss_import_v2_context through legitimate-looking Kerberos context imports; each invocation leaks a small allocation that accumulates until the system becomes unstable.

How to fix it

Update the Linux kernel to a version containing commit 99044c01ed5329e73651c054d8a4baacdbb1a27c or later; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the presence of commit 99044c01ed5329e73651c054d8a4baacdbb1a27c in the running kernel source or verify that /proc/version and kernel package metadata reflect a build after the fix date.

Typical attack path

1. Establish a SUNRPC connection requiring GSS/Kerberos authentication
2. Supply a crafted or repeated v2 context import that exercises the gss_krb5_import_sec_context path
3. Trigger the allocation without hitting the freed path, causing incremental kernel memory loss
4. Repeat to accelerate exhaustion and induce instability or crash

How to detect it

Review kernel logs for repeated GSS context import failures and correlate with rising slab memory usage; inspect /proc/slabinfo or kmemleak reports for unreleased mech_used buffers.

What your security team should do

• Prioritize kernel upgrades on all systems exposing NFS/RPC with Kerberos
• Monitor kernel memory usage and slab statistics for unexpected growth in gss-related caches
• Apply the fix during the next maintenance window if systems are already stable