CVE-2023-53591: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix deadlock in tc route query code Cited commit causes ABBA deadlock[0] when…

PriorityP422medium5.5CVSS 3.1

AVLACLPRLUINSUCNINAH

EPSS

0.12%

2.2th percentile

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix deadlock in tc route query code Cited commit causes ABBA deadlock[0] when peer flows are created while holding the devcom rw semaphore. Due to peer flows offload implementation the lock is taken much higher up the call chain and there is no obvious way to easily fix the deadlock. Instead, since tc route query code needs the peer eswitch structure only to perform a lookup in xarray and doesn't perform any sleeping operations with it, refactor the code for lockless execution in following ways: - RCUify the devcom 'data' pointer. When resetting the pointer synchronously wait for RCU grace period before returning. This is fine since devcom is currently only used for synchronization of pairing/unpairing of eswitches which is rare and already expensive as-is. - Wrap all usages of 'paired' boolean in {READ|WRITE}_ONCE(). The flag has already been used in some unlocked contexts without proper annotations (e.g. users of mlx5_devcom_is_paired() function), but it wasn't an issue since all relevant code paths checked it again after obtaining the devcom semaphore. Now it is also used by mlx5_devcom_get_peer_data_rcu() as "best effort" check to return NULL when devcom is being unpaired. Note that while RCU read lock doesn't prevent the unpaired flag from being changed concurrently it still guarantees that reader can continue to use 'data'. - Refactor mlx5e_tc_query_route_vport() function to use new mlx5_devcom_get_peer_data_rcu() API which fixes the deadlock. [0]: [ 164.599612] ====================================================== [ 164.600142] WARNING: possible circular locking dependency detected [ 164.600667] 6.3.0-rc3+ #1 Not tainted [ 164.601021] ------------------------------------------------------ [ 164.601557] handler1/3456 is trying to acquire lock: [ 164.601998] ffff88811f1714b0 (&esw->offloads.encap_tbl_lock){+.+.}-{3:3}, at: mlx5e_attach_encap+0xd8/0x8b0 [mlx5_core] [ 164.60307

Affected

18 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.37-1 (bookworm)	linux 6.1.37-1 (bookworm)
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	>= 5.13.17 < 5.14	5.14
linux	linux	>= 5.14.4 < 5.15	5.15
linux	linux	>= f9d196bd632b8b79261ec3366c30ec3923ea9a02 < 69966bce28da6aadccfd968b75d128a79da32d17	69966bce28da6aadccfd968b75d128a79da32d17
linux	linux	>= f9d196bd632b8b79261ec3366c30ec3923ea9a02 < 362063df6ceec80b0b6798b61ae03504dcc125a5	362063df6ceec80b0b6798b61ae03504dcc125a5
linux	linux	>= f9d196bd632b8b79261ec3366c30ec3923ea9a02 < a7236e420a7d8082b1df4b3e05c739dd2642a662	a7236e420a7d8082b1df4b3e05c739dd2642a662
linux	linux	>= f9d196bd632b8b79261ec3366c30ec3923ea9a02 < 691c041bf20899fc13c793f92ba61ab660fa3a30	691c041bf20899fc13c793f92ba61ab660fa3a30
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.1.37-1	6.1.37-1
linux	linux_kernel	>= 0 < 6.3.7-1	6.3.7-1
linux	linux_kernel	>= 0 < 6.3.7-1	6.3.7-1
linux	linux_kernel	>= 5.13.17 < 5.14	5.14
linux	linux_kernel	>= 5.14.4 < 5.15.115	5.15.115
linux	linux_kernel	>= 5.16 < 6.1.31	6.1.31
linux	linux_kernel	>= 6.2 < 6.3.5	6.3.5

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv5.5MEDIUM

vendor_debian5.5MEDIUM

vendor_redhat5.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.