CVE-2023-53587: ring-buffer: Sync IRQ works before buffer destruction
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Sync IRQ works before buffer destruction
If something was written to the buffer just before destruction, it may be possible (maybe not in a real system, but it did happen in ARCH=um with time-travel) to destroy the ringbuffer before the IRQ work ran, leading this KASAN report (or a crash without KASAN):
BUG: KASAN: slab-use-after-free in irqworkrunlist+0x11a/0x13a Read of size 8 at addr 000000006d640a48 by task swapper/0
CPU: 0 PID: 0 Comm: swapper Tainted: G W O 6.3.0-rc1 #7 Stack: 60c4f20f 0c203d48 41b58ab3 60f224fc 600477fa 60f35687 60c4f20f 601273dd 00000008 6101eb00 6101eab0 615be548 Call Trace: [<60047a58>] showstack+0x25e/0x282 [<60c609e0>] dumpstacklvl+0x96/0xfd [<60c50d4c>] printreport+0x1a7/0x5a8 [<603078d3>] kasanreport+0xc1/0xe9 [<60308950>] asanreportload8noabort+0x1b/0x1d [<60232844>] irqworkrunlist+0x11a/0x13a [<602328b4>] irqworktick+0x24/0x34 [<6017f9dc>] updateprocesstimes+0x162/0x196 [<6019f335>] tickschedhandle+0x1a4/0x1c3 [<6019fd9e>] tickschedtimer+0x79/0x10c [<601812b9>] hrtimerrunqueues.constprop.0+0x425/0x695 [<60182913>] hrtimerinterrupt+0x16c/0x2c4 [<600486a3>] umtimer+0x164/0x183 [...]
Allocated by task 411: savestacktrace+0x99/0xb5 stacktracesave+0x81/0x9b kasansavestack+0x2d/0x54 kasansettrack+0x34/0x3e kasansaveallocinfo+0x25/0x28 kasankmalloc+0x8b/0x97 kasankmalloc+0x10/0x12 kmalloc+0xb2/0xe8 loadelfphdrs+0xee/0x182 [...]
The buggy address belongs to the object at 000000006d640800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 584 bytes inside of freed 1024-byte region [000000006d640800, 000000006d640c00)
Add the appropriate irqworksync() so the work finishes before the buffers are destroyed.
Prior to the commit in the Fixes tag below, there was only a single global IRQ work, so this issue didn't exist.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure irq_work_sync() is used so the queued IRQ work finishes before ringbuffer destruction ("ring-buffer: Sync IRQ works before buffer destruction").
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53587?
CVE-2023-53587 has a high severity rating due to its potential to allow for unexpected behavior in the Linux kernel.
How does CVE-2023-53587 impact the Linux kernel?
CVE-2023-53587 can lead to issues with synchronization in the ring buffer when IRQs are processed before the buffer is fully destroyed.
What versions of the Linux kernel are affected by CVE-2023-53587?
CVE-2023-53587 affects various versions of the Linux kernel that include the vulnerable ring-buffer code.
How do I fix CVE-2023-53587?
To fix CVE-2023-53587, you should update your Linux kernel to the latest version where this vulnerability has been addressed.
Is CVE-2023-53587 exploitable in real-world scenarios?
While exploitation of CVE-2023-53587 may not be likely in typical real-world applications, it has been demonstrated in specific environments like ARCH=um.