CVE-2023-52704: freezer,umh: Fix call_usermode_helper_exec() vs SIGKILL
In the Linux kernel, the following vulnerability has been resolved:
freezer,umh: Fix callusermodehelperexec() vs SIGKILL
Tetsuo-San noted that commit f5d39b020809 ("freezer,sched: Rewrite core freezer logic") broke callusermodehelperexec() for the KILLABLE case.
Specifically it was missed that the second, unconditional, waitforcompletion() was not optional and ensures the on-stack completion is unused before going out-of-scope.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch f5d39b020809
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52704?
CVE-2023-52704 has been classified with medium severity due to the potential impact on user mode helper execution.
How do I fix CVE-2023-52704?
To fix CVE-2023-52704, upgrade your Linux kernel to a version that includes the patch addressing this vulnerability.
Which versions of the Linux kernel are affected by CVE-2023-52704?
CVE-2023-52704 affects Linux kernel versions between 6.1 inclusive up to but not including 6.2, as well as specific pre-release versions of 6.2.
What is the nature of the issue in CVE-2023-52704?
CVE-2023-52704 is caused by the improper handling of calls to call_usermode_helper_exec() in the context of SIGKILL.
Who reported the vulnerability CVE-2023-52704?
The vulnerability CVE-2023-52704 was noted and reported by the security researcher Tetsuo-San.