ring-buffer: Do not swap cpu_buffer during resize process
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not swap cpu_buffer during resize process When ring_buffer_swap_cpu was called during resize process, the cpu buffer was swapped in the middle, resulting in incorrect state. Continuing to run in the wrong state will result in oops. This issue can be easily reproduced using the following two scripts: /tmp # cat test1.sh //#! /bin/sh for i in `seq 0 100000` do echo 2000 > /sys/kernel/debug/tracing/buffer_size_kb sleep 0.5 echo 5000 > /sys/kernel/debug/tracing/buffer_size_kb sleep 0.5 done /tmp # cat test2.sh //#! /bin/sh for i in `seq 0 100000` do echo irqsoff > /sys/kernel/debug/tracing/current_tracer sleep 1 echo nop > /sys/kernel/debug/tracing/current_tracer sleep 1 done /tmp # ./test1.sh & /tmp # ./test2.sh & A typical oops log is as follows, sometimes with other different oops logs. [ 231.711293] WARNING: CPU: 0 PID: 9 at kernel/trace/ring_buffer.c:2026 rb_update_pages+0x378/0x3f8 [ 231.713375] Modules linked in: [ 231.714735] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15 [ 231.716750] Hardware name: linux,dummy-virt (DT) [ 231.718152] Workqueue: events update_pages_handler [ 231.719714] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 231.721171] pc : rb_update_pages+0x378/0x3f8 [ 231.722212] lr : rb_update_pages+0x25c/0x3f8 [ 231.723248] sp : ffff800082b9bd50 [ 231.724169] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000 [
CVE-2023-53718
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2023-53718
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "83f40318dab00e3298a1f6d0b12ac025e84e478d",
"lessThan": "66a3b2a121386702663065d5c9e5a33c03d3f4a2",
"versionType": "git"
},
{
"status": "affected",
"version": "83f40318dab00e3298a1f6d0b12ac025e84e478d",
"lessThan": "49b830d75f03d5dd41146d10e4d3e2a8211c4b94",
"versionType": "git"
},
{
"status": "affected",
"version": "83f40318dab00e3298a1f6d0b12ac025e84e478d",
"lessThan": "128c06a34cfe55212632533a706b050d54552741",
"versionType": "git"
},
{
"status": "affected",
"version": "83f40318dab00e3298a1f6d0b12ac025e84e478d",
"lessThan": "02e52d7daaa3f0f48819f198092cf4871065bbf7",
"versionType": "git"
},
{
"status": "affected",
"version": "83f40318dab00e3298a1f6d0b12ac025e84e478d",
"lessThan": "8a96c0288d0737ad77882024974c075345c72011",
"versionType": "git"
}
],
"programFiles": [
"kernel/trace/ring_buffer.c",
"kernel/trace/trace.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.192",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.128",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.47",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.4.12",
"versionType": "semver",
"lessThanOrEqual": "6.4.*"
},
{
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"kernel/trace/ring_buffer.c",
"kernel/trace/trace.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2023-53718
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30311 · Revision 1
- Added to Heist Feed
- Publisher date