PT-2023-9493 · Linux+5 · Linux Kernel+5
Daniel Vacek
·
Publicado
2023-12-12
·
Atualizado
2024-11-04
·
CVE-2023-52587
CVSS v3.1
5.5
Média
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 4.18.0-372.75.1.el8 6
Description
The vulnerability is related to the IB/ipoib component of the Linux kernel. It occurs when the
priv->lock is released while iterating the priv->multicast list in ipoib mcast join task(), allowing ipoib mcast dev flush() to remove items during iteration. If the mcast is removed while the lock is dropped, the for loop spins forever, resulting in a hard lockup. This issue can be fixed by keeping the lock held and changing to GFP ATOMIC to prevent eventual sleeps.Recommendations
To resolve this issue, update the Linux kernel to a version that includes the fix for the IB/ipoib component, specifically the patch that addresses the mcast list locking issue. As a temporary workaround, consider disabling the
ipoib mcast join task() function until a patch is available. However, this may have unintended consequences and should be carefully evaluated before implementation.Exploit
Correção
Improper Locking
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu