CVE-2023-53421: blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: Reinit blkgiostatset after clearing in blkcgresetstats()
When blkgalloc() is called to allocate a blkcggq structure with the associated blkgiostatset's, there are 2 fields within blkgiostatset that requires proper initialization - blkg & sync. The former field was introduced by commit 3b8cc6298724 ("blk-cgroup: Optimize blkcgrstatflush()") while the later one was introduced by commit f73316482977 ("blk-cgroup: reimplement basic IO stats using cgroup rstat").
Unfortunately those fields in the blkgiostatset's are not properly re-initialized when they are cleared in v1's blkcgresetstats(). This can lead to a kernel panic due to NULL pointer access of the blkg pointer. The missing initialization of sync is less problematic and can be a problem in a debug kernel due to missing lockdep initialization.
Fix these problems by re-initializing them after memory clearing.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53421?
The severity of CVE-2023-53421 has been classified as high due to its impact on the Linux kernel.
How do I fix CVE-2023-53421?
To fix CVE-2023-53421, update the Linux kernel to the latest patched version.
What systems are affected by CVE-2023-53421?
CVE-2023-53421 affects the Linux kernel across various distributions.
What type of vulnerability is CVE-2023-53421?
CVE-2023-53421 is a kernel security vulnerability related to block I/O accounting.
Is there a workaround for CVE-2023-53421?
Currently, there are no known effective workarounds for CVE-2023-53421, making an update essential.