CVE-2023-54088: blk-cgroup: hold queue_lock when removing blkg->q_node
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: hold queuelock when removing blkg->qnode
When blkg is removed from q->blkglist from blkgfreeworkfn(), queuelock has to be held, otherwise, all kinds of bugs(list corruption, hard lockup, ..) can be triggered from blkgdestroyall().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Patch the kernel so that queue_lock is held while removing blkg->q_node from q->blkg_list in blkg_free_workfn() (blkg_free_workfn/related worker). This prevents list corruption and hard lockups.
Linux kernel blk-cgroup queue_lock handling = Hold queue_lock when removing blkg->q_node from q->blkg_list in blkg_free_workfn()/blkg_free_workfn()
Event History
Frequently Asked Questions
What is the severity of CVE-2023-54088?
CVE-2023-54088 has been classified as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2023-54088?
To fix CVE-2023-54088, users should update to the latest patched version of the Linux kernel that addresses this vulnerability.
Which versions of Linux kernel are affected by CVE-2023-54088?
CVE-2023-54088 affects multiple versions of the Linux kernel prior to the patch release.
What type of issues can CVE-2023-54088 cause?
CVE-2023-54088 can lead to list corruption, hard lockup, and various unspecified bugs.
Is CVE-2023-54088 a remote exploit vulnerability?
CVE-2023-54088 is considered a local privilege escalation vulnerability rather than a remote exploit.