CVE-2023-52654

What it actually does

Allows io_uring file descriptors to be passed over UNIX domain sockets via SCM_RIGHTS, creating reference cycles that race with unix_stream_read_generic and render SCM accounting ineffective.

Why it matters to the business

Systems relying on io_uring for high-performance I/O may experience kernel instability or crashes when file descriptors are passed over sockets; older Ubuntu LTS releases with affected spice packages face elevated operational risk until updated.

How an attack unfolds

An attacker crafts a process that registers io_uring files, then sends the associated file descriptors over a UNIX socket using SCM_RIGHTS; concurrent reads on the receiving side trigger the reference-cycle race, potentially leading to use-after-free or denial of service.

How to fix it

Upgrade the Linux kernel to 5.4.264 or later; on Ubuntu 14.04 LTS update spice to 0.12.4-0nocelt2ubuntu1.8, on 16.04 LTS to 0.12.6-4ubuntu0.4, and on 18.04 LTS to 0.14.0-1ubuntu2.4. Disable io_uring or block SCM_RIGHTS passing of io_uring files as a temporary mitigation where upgrades are delayed.

How to confirm the fix worked

Verify running kernel version is at or above the listed fixed releases; confirm spice package versions match the stated fixed releases on affected Ubuntu releases; test that attempts to send io_uring file descriptors over UNIX sockets are now rejected by the kernel.

Typical attack path

1. Obtain or create a process that uses io_uring with registered files
2. Establish a UNIX domain socket pair between attacker-controlled processes
3. Transmit the io_uring file descriptor via SCM_RIGHTS sendmsg
4. Trigger concurrent unix_stream_read_generic on the receiving side to hit the race
5. Observe kernel instability or crash resulting from the cycle

How to detect it

Review kernel logs for oops or warnings related to io_uring and unix_stream; inspect auditd or syscall traces for sendmsg calls carrying SCM_RIGHTS with io_uring file descriptors; correlate with processes using io_uring and UNIX sockets.

What your security team should do

• Apply kernel and spice package updates immediately on all affected systems
• Audit workloads that combine io_uring with socket descriptor passing and refactor to remove the pattern
• Monitor EPSS and KEV status for any future increase in exploit maturity
• Add kernel version checks to vulnerability scanning and asset inventory pipelines