Skip to content
Heist/ feed
Unrated

blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init blk-iocost sometimes causes the following crash: BUG: kernel NULL pointer dereference, address: 00000000000000e0 ... RIP: 0010:_raw_spin_lock+0x17/0x30 Code: be 01 02 00 00 e8 79 38 39 ff 31 d2 89 d0 5d c3 0f 1f 00 0f 1f 44 00 00 55 48 89 e5 65 ff 05 48 d0 34 7e b9 01 00 00 00 31 c0 0f b1 0f 75 02 5d c3 89 c6 e8 ea 04 00 00 5d c3 0f 1f 84 00 00 RSP: 0018:ffffc900023b3d40 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 00000000000000e0 RCX: 0000000000000001 RDX: ffffc900023b3d20 RSI: ffffc900023b3cf0 RDI: 00000000000000e0 RBP: ffffc900023b3d40 R08: ffffc900023b3c10 R09: 0000000000000003 R10: 0000000000000064 R11: 000000000000000a R12: ffff888102337000 R13: fffffffffffffff2 R14: ffff88810af408c8 R15: ffff8881070c3600 FS: 00007faaaf364fc0(0000) GS:ffff88842fdc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000e0 CR3: 00000001097b1000 CR4: 0000000000350ea0 Call Trace: ioc_weight_write+0x13d/0x410 cgroup_file_write+0x7a/0x130 kernfs_fop_write_iter+0xf5/0x170 vfs_write+0x298/0x370 ksys_write+0x5f/0xb0 __x64_sys_write+0x1b/0x20 do_syscall_64+0x3d/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 This happens because iocg->ioc is NULL. The field is initialized by ioc_pd_init() and never cleared. The NULL deref is caused by blkcg_activate_policy() installing blkg_policy_data before initializing

Announced Source revision 1
Original source ↗

CVE-2023-54271

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2023-54271

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "9d179b865449b351ad5cb76dbea480c9170d4a27",
        "lessThan": "da6cc648c1f570290af1ddbe6b7ca3d91b1d6db9",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "9d179b865449b351ad5cb76dbea480c9170d4a27",
        "lessThan": "33f0370bb7ce15a59d72a4d8a05421d334a04add",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "9d179b865449b351ad5cb76dbea480c9170d4a27",
        "lessThan": "e39ef7880d1057b2ebcdb013405f4d84a257db23",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "9d179b865449b351ad5cb76dbea480c9170d4a27",
        "lessThan": "7d63c6f9765339dcfc34b7365ced7c518012e4fe",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "9d179b865449b351ad5cb76dbea480c9170d4a27",
        "lessThan": "ec14a87ee1999b19d8b7ed0fa95fea80644624ae",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "block/blk-cgroup.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.4"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.4",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.15.210",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.176",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.4.16",
        "versionType": "semver",
        "lessThanOrEqual": "6.4.*"
      },
      {
        "status": "unaffected",
        "version": "6.5.3",
        "versionType": "semver",
        "lessThanOrEqual": "6.5.*"
      },
      {
        "status": "unaffected",
        "version": "6.6",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "block/blk-cgroup.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2023-54271

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#26388 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement