CVE-2023-52836
published 2024-05-21CVE-2023-52836: In the Linux kernel, the following vulnerability has been resolved: locking/ww_mutex/test: Fix potential workqueue corruption In some cases running with the…
PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.26%
17.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
locking/ww_mutex/test: Fix potential workqueue corruption
In some cases running with the test-ww_mutex code, I was seeing
odd behavior where sometimes it seemed flush_workqueue was
returning before all the work threads were finished.
Often this would cause strange crashes as the mutexes would be
freed while they were being used.
Looking at the code, there is a lifetime problem as the
controlling thread that spawns the work allocates the
"struct stress" structures that are passed to the workqueue
threads. Then when the workqueue threads are finished,
they free the stress struct that was passed to them.
Unfortunately the workqueue work_struct node is in the stress
struct. Which means the work_struct is freed before the work
thread returns and while flush_workqueue is waiting.
It seems like a better idea to have the controlling thread
both allocate and free the stress structures, so that we can
be sure we don't corrupt the workqueue by freeing the structure
prematurely.
So this patch reworks the test to do so, and with this change
I no longer see the early flush_workqueue returns.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.64-1 (bookworm) | linux 6.1.64-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 2a0c11282881875dc44f166a20eedf0d866dd0ef < d4d37c9e6a4dbcca958dabd99216550525c7e389 | d4d37c9e6a4dbcca958dabd99216550525c7e389 |
| linux | linux | >= 2a0c11282881875dc44f166a20eedf0d866dd0ef < d8267cabbe1bed15ccf8b0e684c528bf8eeef715 | d8267cabbe1bed15ccf8b0e684c528bf8eeef715 |
| linux | linux | >= 2a0c11282881875dc44f166a20eedf0d866dd0ef < dcd85e3c929368076a7592b27f541e0da8b427f5 | dcd85e3c929368076a7592b27f541e0da8b427f5 |
| linux | linux | >= 2a0c11282881875dc44f166a20eedf0d866dd0ef < 9ed2d68b3925145f5f51c46559484881d6082f75 | 9ed2d68b3925145f5f51c46559484881d6082f75 |
| linux | linux | >= 2a0c11282881875dc44f166a20eedf0d866dd0ef < e89d0ed45a419c485bae999426ecf92697cbdda3 | e89d0ed45a419c485bae999426ecf92697cbdda3 |
| linux | linux | >= 2a0c11282881875dc44f166a20eedf0d866dd0ef < c56df79d68677cf062da1b6e3b33e74299a92dfc | c56df79d68677cf062da1b6e3b33e74299a92dfc |
| linux | linux | >= 2a0c11282881875dc44f166a20eedf0d866dd0ef < e36407713163363e65566e7af0abe207d5f59a0c | e36407713163363e65566e7af0abe207d5f59a0c |
| linux | linux | >= 2a0c11282881875dc44f166a20eedf0d866dd0ef < 304a2c4aad0fff887ce493e4197bf9cbaf394479 | 304a2c4aad0fff887ce493e4197bf9cbaf394479 |
| linux | linux | >= 2a0c11282881875dc44f166a20eedf0d866dd0ef < bccdd808902f8c677317cec47c306e42b93b849e | bccdd808902f8c677317cec47c306e42b93b849e |
| linux | linux_kernel | < 4.14.331 | 4.14.331 |
| linux | linux_kernel | >= 0 < 5.10.205-1 | 5.10.205-1 |
| linux | linux_kernel | >= 0 < 6.1.64-1 | 6.1.64-1 |
| linux | linux_kernel | >= 0 < 6.6.8-1 | 6.6.8-1 |
| linux | linux_kernel | >= 0 < 6.6.8-1 | 6.6.8-1 |
| linux | linux_kernel | >= 4.15 < 4.19.300 | 4.19.300 |
| linux | linux_kernel | >= 4.20 < 5.4.262 | 5.4.262 |
| linux | linux_kernel | >= 5.11 < 5.15.140 | 5.15.140 |
| linux | linux_kernel | >= 5.16 < 6.1.64 | 6.1.64 |
| linux | linux_kernel | >= 5.5 < 5.10.202 | 5.10.202 |
| linux | linux_kernel | >= 6.2 < 6.5.13 | 6.5.13 |
| linux | linux_kernel | >= 6.6 < 6.6.3 | 6.6.3 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SINEC OS
cisa_ics·2025-08-14
Siemens SINEC OS
ICS Advisory
##
Siemens SINEC OS
Release DateAugust 14, 2025
Alert CodeICSA-25-226-15
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3.1 9.1
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: RUGGEDCOM, SCALANCE
- Vulnerabilities: NULL Pointer Dereference, Use After Free, Unchecked Input for Loop Condition, Out-of-bounds Write, Ou
Red Hat
kernel: locking/ww_mutex/test: Fix potential workqueue corruption
vendor_redhat·2024-05-21·CVSS 7.8
CVE-2023-52836 [HIGH] CWE-99 kernel: locking/ww_mutex/test: Fix potential workqueue corruption
kernel: locking/ww_mutex/test: Fix potential workqueue corruption
In the Linux kernel, the following vulnerability has been resolved:
locking/ww_mutex/test: Fix potential workqueue corruption
In some cases running with the test-ww_mutex code, I was seeing
odd behavior where sometimes it seemed flush_workqueue was
returning before all the work threads were finished.
Often this would cause strange crashes as the mutexes would be
freed while they were being used.
Looking at the code, there is a lifetime problem as the
controlling thread that spawns the work allocates the
"struct stress" structures that are passed to the workqueue
threads. Then when the workqueue threads are finished,
they free the stress struct that was passed to them.
Unfortunately the workqueue work_struct node is in the s
Debian
CVE-2023-52836: linux - In the Linux kernel, the following vulnerability has been resolved: locking/ww_...
vendor_debian·2023·CVSS 7.8
CVE-2023-52836 [HIGH] CVE-2023-52836: linux - In the Linux kernel, the following vulnerability has been resolved: locking/ww_...
In the Linux kernel, the following vulnerability has been resolved: locking/ww_mutex/test: Fix potential workqueue corruption In some cases running with the test-ww_mutex code, I was seeing odd behavior where sometimes it seemed flush_workqueue was returning before all the work threads were finished. Often this would cause strange crashes as the mutexes would be freed while they were being used. Looking at the code, there is a lifetime problem as the controlling thread that spawns the work allocates the "struct stress" structures that are passed to the workqueue threads. Then when the workqueue threads are finished, they free the stress struct that was passed to them. Unfortunately the workqueue work_struct node is in the stress struct. Which means the work_struct is freed before the work
OSV
CVE-2023-52836: In the Linux kernel, the following vulnerability has been resolved: locking/ww_mutex/test: Fix potential workqueue corruption In some cases running wi
osv·2024-05-21·CVSS 7.8
CVE-2023-52836 [HIGH] CVE-2023-52836: In the Linux kernel, the following vulnerability has been resolved: locking/ww_mutex/test: Fix potential workqueue corruption In some cases running wi
In the Linux kernel, the following vulnerability has been resolved: locking/ww_mutex/test: Fix potential workqueue corruption In some cases running with the test-ww_mutex code, I was seeing odd behavior where sometimes it seemed flush_workqueue was returning before all the work threads were finished. Often this would cause strange crashes as the mutexes would be freed while they were being used. Looking at the code, there is a lifetime problem as the controlling thread that spawns the work allocates the "struct stress" structures that are passed to the workqueue threads. Then when the workqueue threads are finished, they free the stress struct that was passed to them. Unfortunately the workqueue work_struct node is in the stress struct. Which means the work_struct is freed before the work
GHSA
GHSA-xj3r-45pc-vrfq: In the Linux kernel, the following vulnerability has been resolved:
locking/ww_mutex/test: Fix potential workqueue corruption
In some cases running
ghsa_unreviewed·2024-05-21
CVE-2023-52836 [HIGH] CWE-787 GHSA-xj3r-45pc-vrfq: In the Linux kernel, the following vulnerability has been resolved:
locking/ww_mutex/test: Fix potential workqueue corruption
In some cases running
In the Linux kernel, the following vulnerability has been resolved:
locking/ww_mutex/test: Fix potential workqueue corruption
In some cases running with the test-ww_mutex code, I was seeing
odd behavior where sometimes it seemed flush_workqueue was
returning before all the work threads were finished.
Often this would cause strange crashes as the mutexes would be
freed while they were being used.
Looking at the code, there is a lifetime problem as the
controlling thread that spawns the work allocates the
"struct stress" structures that are passed to the workqueue
threads. Then when the workqueue threads are finished,
they free the stress struct that was passed to them.
Unfortunately the workqueue work_struct node is in the stress
struct. Which means the work_struct is freed before the
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/304a2c4aad0fff887ce493e4197bf9cbaf394479https://git.kernel.org/stable/c/9ed2d68b3925145f5f51c46559484881d6082f75https://git.kernel.org/stable/c/bccdd808902f8c677317cec47c306e42b93b849ehttps://git.kernel.org/stable/c/c56df79d68677cf062da1b6e3b33e74299a92dfchttps://git.kernel.org/stable/c/d4d37c9e6a4dbcca958dabd99216550525c7e389https://git.kernel.org/stable/c/d8267cabbe1bed15ccf8b0e684c528bf8eeef715https://git.kernel.org/stable/c/dcd85e3c929368076a7592b27f541e0da8b427f5https://git.kernel.org/stable/c/e36407713163363e65566e7af0abe207d5f59a0chttps://git.kernel.org/stable/c/e89d0ed45a419c485bae999426ecf92697cbdda3https://git.kernel.org/stable/c/304a2c4aad0fff887ce493e4197bf9cbaf394479https://git.kernel.org/stable/c/9ed2d68b3925145f5f51c46559484881d6082f75https://git.kernel.org/stable/c/bccdd808902f8c677317cec47c306e42b93b849ehttps://git.kernel.org/stable/c/c56df79d68677cf062da1b6e3b33e74299a92dfchttps://git.kernel.org/stable/c/d4d37c9e6a4dbcca958dabd99216550525c7e389https://git.kernel.org/stable/c/d8267cabbe1bed15ccf8b0e684c528bf8eeef715https://git.kernel.org/stable/c/dcd85e3c929368076a7592b27f541e0da8b427f5https://git.kernel.org/stable/c/e36407713163363e65566e7af0abe207d5f59a0chttps://git.kernel.org/stable/c/e89d0ed45a419c485bae999426ecf92697cbdda3
2024-05-21
Published