CVE-2023-53307

What it actually does

Use-after-free triggered in do_rbd_add() after rbd_dev_create() fails and frees rbd_dev->rbd_client, rbd_dev->spec and rbd_dev->opts that had been transferred prematurely.

Why it matters to the business

Kernel memory corruption on systems using RBD storage can cause crashes, denial of service, or local privilege escalation; low EPSS and no KEV status indicate limited active exploitation but still requires prompt patching on affected kernels.

How an attack unfolds

An attacker with local access crafts an RBD add operation that forces rbd_dev_create() to fail after ownership transfer; the subsequent use of the already-freed structures in do_rbd_add() produces a use-after-free that can be leveraged for memory corruption.

How to fix it

Upgrade to a kernel containing commit 71da2a151ed1adb0aea4252b16d81b53012e7afd or later; for listed Debian VLC packages apply 0.9.8a-1 or newer; verify the exact fixed version for each distribution and rebuild/initramfs as needed.

How to confirm the fix worked

Confirm the running kernel contains the cited commit or package version; attempt to reproduce the original failure path in a test environment and ensure no use-after-free reports occur under memory debugging tools such as KASAN.

Typical attack path

1. Obtain local access or execute code on a system with RBD support
2. Trigger rbd_dev_create() failure path by supplying malformed ID or work-queue setup
3. Cause do_rbd_add() to dereference freed rbd_client/spec/opts structures
4. Exploit resulting use-after-free for memory corruption or control-flow hijack

How to detect it

Review kernel logs for use-after-free or slab corruption messages around RBD device creation; inspect audit logs for unusual rbd add attempts; correlate with process activity that interacts with /sys/bus/rbd or ceph-rbd utilities.

What your security team should do

• Prioritize kernel updates on any host using RBD or Ceph storage
• Monitor EPSS trend and threat actor mentions for changes in exploit maturity
• Apply the exact fixed versions listed for each affected package
• Test RBD device attach/detach operations after patching to validate stability