CVE-2023-52837

What it actually does

Use-after-free in the nbd block driver where nbd_open() dereferences a freed nbd device structure because blk_cleanup_disk() no longer clears disk->private_data and nbd_dev_remove() has already released the private data.

Why it matters to the business

Kernel memory corruption or crash on systems exposing nbd devices, potentially allowing local privilege escalation or denial of service; high prevalence in Linux distributions increases patch urgency.

How an attack unfolds

An attacker with local access races nbd_put() followed by nbd_open() on the same device node; the open path reads from already-freed memory, enabling controlled corruption or information disclosure. The listed Android kernel RCE actor context indicates similar patterns have been targeted in mobile kernels.

How to fix it

Upgrade to a kernel containing commit 4e9b3ec84dc97909876641dad14e0a2300d6c2a3 or later; apply the fixed version 5.5.9+dfsg-1ubuntu4.16 for affected Ubuntu 14.04 php5 packages where applicable; enable CONFIG_BLK_DEV_NBD=n or restrict device node access until patched.

How to confirm the fix worked

Verify kernel git commit or package version contains the free_disk callback implementation; inspect /proc/kallsyms or source for nbd_free_disk; attempt open after teardown in a test environment and confirm no UAF warning in dmesg.

Typical attack path

1. Obtain local access on a system with nbd configured
2. Trigger device teardown via nbd-client disconnect or module unload
3. Immediately attempt open() on the corresponding /dev/nbdX node
4. Trigger UAF read/write in nbd_open() to corrupt kernel structures

How to detect it

Search kernel logs for nbd_open UAF splats or general protection faults referencing nbd_dev; correlate with process activity opening nbd character devices immediately after nbd-client teardown events.

• nbd_open: use after free
• general protection fault in nbd_open
• /dev/nbd[0-9] opened immediately after nbd_put

What your security team should do

• Apply the referenced kernel commit or distribution update within 30 days given the published date and stable EPSS
• Restrict nbd device permissions to root-only until patched
• Monitor for nbd-related kernel warnings in production fleets
• Audit systems for nbd usage and prioritize those exposing block devices to untrusted processes