CVE-2023-52760: gfs2: Fix slab-use-after-free in gfs2_qd_dealloc
gfs2: Fix slab-use-after-free in gfs2qddealloc
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
In gfs2_put_super(), ensure quota is cleaned up by calling gfs2_quota_cleanup() regardless of whether the filesystem is withdrawn. Also, after calling gfs2_make_fs_ro(), do not call gfs2_destroy_threads() and gfs2_quota_cleanup() again since gfs2_make_fs_ro() already calls them.
Linux kernel (gfs2) gfs2_put_super() cleanup flow = Call gfs2_quota_cleanup() in gfs2_put_super() whether the filesystem is withdrawn or not; do not rely on gfs2_destroy_threads() / gfs2_quota_cleanup() being handled solely by gfs2_make_fs_ro()
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52760?
CVE-2023-52760 has a high severity due to the potential for a slab-use-after-free vulnerability in the Linux kernel.
How do I fix CVE-2023-52760?
To fix CVE-2023-52760, you should update your Linux kernel to a remedied version such as 6.1.123-1 or later.
Which Linux kernel versions are affected by CVE-2023-52760?
CVE-2023-52760 affects Linux kernel versions from 5.10.223-1 up to, but not including, 6.1.97.
Is CVE-2023-52760 specific to Debian Linux?
Yes, CVE-2023-52760 specifically affects certain Debian Linux packages, including linux and linux-6.1.
What component of the Linux kernel is impacted by CVE-2023-52760?
CVE-2023-52760 impacts the gfs2 filesystem component of the Linux kernel.