CVE-2023-53709: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Handle race between rb_move_tail and rb_check_pages It seems a data race…

PriorityP423low5.5

EPSS

0.19%

8.4th percentile

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Handle race between rb_move_tail and rb_check_pages It seems a data race between ring_buffer writing and integrity check. That is, RB_FLAG of head_page is been updating, while at same time RB_FLAG was cleared when doing integrity check rb_check_pages(): rb_check_pages() rb_handle_head_page(): -------- -------- rb_head_page_deactivate() rb_head_page_set_normal() rb_head_page_activate() We do intergrity test of the list to check if the list is corrupted and it is still worth doing it. So, let's refactor rb_check_pages() such that we no longer clear and set flag during the list sanity checking. [1] and [2] are the test to reproduce and the crash report respectively. 1: ``` read_trace.sh while true; do # the "trace" file is closed after read head -1 /sys/kernel/tracing/trace > /dev/null done ``` ``` repro.sh sysctl -w kernel.panic_on_warn=1 # function tracer will writing enough data into ring_buffer echo function > /sys/kernel/tracing/current_tracer ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ``` 2: ------------[ cut here ]------------ WARNING: CPU: 9 PID: 62 at kernel/trace/ring_buffer.c:2653 rb_move_tail+0x450/0x470 Modules linked in: CPU: 9 PID: 62 Comm: ksoftirqd/9 Tainted: G W 6.2.0-rc6+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:rb_move_tail+0x450/0x470 Code: ff ff 4c 89 c8 f0 4d 0f b1 02 48 89 c2 48 83 e2 fc 49 39 d0 75 24 83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 0b 83 f8 02 0f 84 ce fb ff ff e9 db RSP: 0018:ffffb5564089bd00 EFLAGS: 00000203 RAX: 0000000000000000 RBX: ffff9db385a2bf81 RCX: ffffb5564089bd18 RDX: ffff9db281110100 RSI: 0000000000000fe4 RDI: ffff9db380145400 RBP: ffff9db385a2bf80 R08: ffff9db385a2bfc0 R09: ffff9db385a2bfc2 R10: ffff9db385a6c000 R11: ffff9db385a2bf80

Affected

15 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.20-1 (bookworm)	linux 6.1.20-1 (bookworm)
linux	linux	—	—
linux	linux	>= 1039221cc2787dee51a7ffbf9b0e79d192dadf76 < 6e02a43acd0691791df79ce538f2dd497a6c9b76	6e02a43acd0691791df79ce538f2dd497a6c9b76
linux	linux	>= 1039221cc2787dee51a7ffbf9b0e79d192dadf76 < d41db100bc386b9433a3fc87026f5e8b453653e3	d41db100bc386b9433a3fc87026f5e8b453653e3
linux	linux	>= 1039221cc2787dee51a7ffbf9b0e79d192dadf76 < 9674390ac540ed06768e3fbc2dba553929fbd736	9674390ac540ed06768e3fbc2dba553929fbd736
linux	linux	>= 1039221cc2787dee51a7ffbf9b0e79d192dadf76 < 09b1bf25f7f7a8f2bf8cd4278bba9c3172db8013	09b1bf25f7f7a8f2bf8cd4278bba9c3172db8013
linux	linux	>= 1039221cc2787dee51a7ffbf9b0e79d192dadf76 < 8843e06f67b14f71c044bf6267b2387784c7e198	8843e06f67b14f71c044bf6267b2387784c7e198
linux	linux_kernel	>= 0 < 5.10.178-1	5.10.178-1
linux	linux_kernel	>= 0 < 6.1.20-1	6.1.20-1
linux	linux_kernel	>= 0 < 6.1.20-1	6.1.20-1
linux	linux_kernel	>= 0 < 6.1.20-1	6.1.20-1
linux	linux_kernel	>= 5.11.0 < 5.15.99	5.15.99
linux	linux_kernel	>= 5.16.0 < 6.1.16	6.1.16
linux	linux_kernel	>= 5.7.0 < 5.10.173	5.10.173
linux	linux_kernel	>= 6.2.0 < 6.2.3	6.2.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.