CVE-2023-52562

published 2024-03-02

CVE-2023-52562: In the Linux kernel, the following vulnerability has been resolved: mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy() After the commit…

Priority P4 20 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy()

After the commit in Fixes:, if a module that created a slab cache does not
release all of its allocated objects before destroying the cache (at rmmod
time), we might end up releasing the kmem_cache object without removing it
from the slab_caches list thus corrupting the list as kmem_cache_destroy()
ignores the return value from shutdown_cache(), which in turn never removes
the kmem_cache object from slabs_list in case __kmem_cache_shutdown() fails
to release all of the cache's slabs.

This is easily observable on a kernel built with CONFIG_DEBUG_LIST=y
as after that ill release the system will immediately trip on list_add,
or list_del, assertions similar to the one shown below as soon as another
kmem_cache gets created, or destroyed:

[ 1041.213632] list_del corruption. next->prev should be ffff89f596fb5768, but was 52f1e5016aeee75d. (next=ffff89f595a1b268)
[ 1041.219165] ------------[ cut here ]------------
[ 1041.221517] kernel BUG at lib/list_debug.c:62!
[ 1041.223452] invalid opcode: 0000 [#1] PREEMPT SMP PTI
[ 1041.225408] CPU: 2 PID: 1852 Comm: rmmod Kdump: loaded Tainted: G B W OE 6.5.0 #15
[ 1041.228244] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230524-3.fc37 05/24/2023
[ 1041.231212] RIP: 0010:__list_del_entry_valid+0xae/0xb0

Another quick way to trigger this issue, in a kernel with CONFIG_SLUB=y,
is to set slub_debug to poison the released objects and then just run
cat /proc/slabinfo after removing the module that leaks slab objects,
in which case the kernel will panic:

[ 50.954843] general protection fault, probably for non-canonical address 0xa56b6b6b6b6b6b8b: 0000 [#1] PREEMPT SMP PTI
[ 50.961545] CPU: 2 PID: 1495 Comm: cat Kdump: loaded Tainted: G B W OE 6.5.0 #15
[ 50.966808] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230524-3.fc37 05/24/2023
[ 50.972663] RIP: 0010

Affected

13 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.64-1 (bookworm)	linux 6.1.64-1 (bookworm)
linux	linux	—	—
linux	linux	—	—
linux	linux	>= 0495e337b7039191dfce6e03f5f830454b1fae6b < a5569bb187521432f509b69dda7d29f78b2d38b0	a5569bb187521432f509b69dda7d29f78b2d38b0
linux	linux	>= 0495e337b7039191dfce6e03f5f830454b1fae6b < 51988be187b041e5355245957b0b9751fa382e0d	51988be187b041e5355245957b0b9751fa382e0d
linux	linux	>= 0495e337b7039191dfce6e03f5f830454b1fae6b < 46a9ea6681907a3be6b6b0d43776dccc62cad6cf	46a9ea6681907a3be6b6b0d43776dccc62cad6cf
linux	linux	>= 5.19.8 < 5.20	5.20
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.1.64-1	6.1.64-1
linux	linux_kernel	>= 0 < 6.5.6-1	6.5.6-1
linux	linux_kernel	>= 0 < 6.5.6-1	6.5.6-1
linux	linux_kernel	>= 6.0 < 6.1.56	6.1.56
linux	linux_kernel	>= 6.2 < 6.5.6	6.5.6

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-401