CVE-2023-52854

published 2024-05-21

CVE-2023-52854: In the Linux kernel, the following vulnerability has been resolved: padata: Fix refcnt handling in padata_free_shell() In a high-load arm64 environment, the…

Priority P3 39 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

In the Linux kernel, the following vulnerability has been resolved:

padata: Fix refcnt handling in padata_free_shell()

In a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead
to system UAF (Use-After-Free) issues. Due to the lengthy analysis of
the pcrypt_aead01 function call, I'll describe the problem scenario
using a simplified model:

Suppose there's a user of padata named `user_function` that adheres to
the padata requirement of calling `padata_free_shell` after `serial()`
has been invoked, as demonstrated in the following code:

```c
struct request {
struct padata_priv padata;
struct completion *done;
};

void parallel(struct padata_priv *padata) {
do_something();
}

void serial(struct padata_priv *padata) {
struct request *request = container_of(padata,
struct request,
padata);
complete(request->done);
}

void user_function() {
DECLARE_COMPLETION(done)
padata->parallel = parallel;
padata->serial = serial;
padata_do_parallel();
wait_for_completion(&done);
padata_free_shell();
}
```

In the corresponding padata.c file, there's the following code:

```c
static void padata_serial_worker(struct work_struct *serial_work) {
...
cnt = 0;

while (!list_empty(&local_list)) {
...
padata->serial(padata);
cnt++;
}

local_bh_enable();

if (refcount_sub_and_test(cnt, &pd->refcnt))
padata_free_pd(pd);
}
```

Because of the high system load and the accumulation of unexecuted
softirq at this moment, `local_bh_enable()` in padata takes longer
to execute than usual. Subsequently, when accessing `pd->refcnt`,
`pd` has already been released by `padata_free_shell()`, resulting
in a UAF issue with `pd->refcnt`.

The fix is straightforward: add `refcount_dec_and_test` before calling
`padata_free_pd` in `padata_free_shell`.

Affected

38 ranges · showing 25

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.64-1 (bookworm)	linux 6.1.64-1 (bookworm)
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	>= 07928d9bfc81640bab36f5190e8725894d93b659 < 41aad9d6953984d134fc50f631f24ef476875d4d	41aad9d6953984d134fc50f631f24ef476875d4d
linux	linux	>= 07928d9bfc81640bab36f5190e8725894d93b659 < 0dd34a7ad395dbcf6ae60e48e9786050e25b9bc5	0dd34a7ad395dbcf6ae60e48e9786050e25b9bc5
linux	linux	>= 07928d9bfc81640bab36f5190e8725894d93b659 < c7c26d0ef5d20f00dbb2ae3befcabbe0efa77275	c7c26d0ef5d20f00dbb2ae3befcabbe0efa77275
linux	linux	>= 07928d9bfc81640bab36f5190e8725894d93b659 < 1e901bcb8af19416b65f5063a4af7996e5a51d7f	1e901bcb8af19416b65f5063a4af7996e5a51d7f
linux	linux	>= 07928d9bfc81640bab36f5190e8725894d93b659 < 1734a79e951914f1db2c65e635012a35db1c674b	1734a79e951914f1db2c65e635012a35db1c674b
linux	linux	>= 07928d9bfc81640bab36f5190e8725894d93b659 < 7ddc21e317b360c3444de3023bcc83b85fabae2f	7ddc21e317b360c3444de3023bcc83b85fabae2f
linux	linux	>= 3.16.84 < 3.17	3.17
linux	linux	>= 4.14.172 < 4.15	4.15
linux	linux	>= 4.19.103 < 4.20	4.20
linux	linux	>= 4.4.215 < 4.5	4.5
linux	linux	>= 4.9.215 < 4.10	4.10
linux	linux	>= 5.4.19 < 5.5	5.5
linux	linux	>= 5.5.3 < 5.6	5.6
linux	linux_kernel	>= 0 < 5.10.205-1	5.10.205-1
linux	linux_kernel	>= 0 < 6.1.64-1	6.1.64-1
linux	linux_kernel	>= 0 < 6.6.8-1	6.6.8-1

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

osv 7.8 HIGH

vendor_debian 7.8 HIGH

vendor_redhat 7.8 HIGH

vendor_ubuntu 7.8 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-416