Skip to content
Heist/ feed
High

ring-buffer: Do not swap cpu_buffer during resize process

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not swap cpu_buffer during resize process When ring_buffer_swap_cpu was called during resize process, the cpu buffer was swapped in the middle, resulting in incorrect state. Continuing to run in the wrong state will result in oops. This issue can be easily reproduced using the following two scripts: /tmp # cat test1.sh //#! /bin/sh for i in `seq 0 100000` do echo 2000 > /sys/kernel/debug/tracing/buffer_size_kb sleep 0.5 echo 5000 > /sys/kernel/debug/tracing/buffer_size_kb sleep 0.5 done /tmp # cat test2.sh //#! /bin/sh for i in `seq 0 100000` do echo irqsoff > /sys/kernel/debug/tracing/current_tracer sleep 1 echo nop > /sys/kernel/debug/tracing/current_tracer sleep 1 done /tmp # ./test1.sh & /tmp # ./test2.sh & A typical oops log is as follows, sometimes with other different oops logs. [ 231.711293] WARNING: CPU: 0 PID: 9 at kernel/trace/ring_buffer.c:2026 rb_update_pages+0x378/0x3f8 [ 231.713375] Modules linked in: [ 231.714735] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15 [ 231.716750] Hardware name: linux,dummy-virt (DT) [ 231.718152] Workqueue: events update_pages_handler [ 231.719714] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 231.721171] pc : rb_update_pages+0x378/0x3f8 [ 231.722212] lr : rb_update_pages+0x25c/0x3f8 [ 231.723248] sp : ffff800082b9bd50 [ 231.724169] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000 [

Announced Source revision 1
Original source ↗

CVE-2023-53718

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2023-53718

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "83f40318dab00e3298a1f6d0b12ac025e84e478d",
        "lessThan": "66a3b2a121386702663065d5c9e5a33c03d3f4a2",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "83f40318dab00e3298a1f6d0b12ac025e84e478d",
        "lessThan": "49b830d75f03d5dd41146d10e4d3e2a8211c4b94",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "83f40318dab00e3298a1f6d0b12ac025e84e478d",
        "lessThan": "128c06a34cfe55212632533a706b050d54552741",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "83f40318dab00e3298a1f6d0b12ac025e84e478d",
        "lessThan": "02e52d7daaa3f0f48819f198092cf4871065bbf7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "83f40318dab00e3298a1f6d0b12ac025e84e478d",
        "lessThan": "8a96c0288d0737ad77882024974c075345c72011",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "kernel/trace/ring_buffer.c",
      "kernel/trace/trace.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3.5"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "3.5",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.192",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.128",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.47",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.4.12",
        "versionType": "semver",
        "lessThanOrEqual": "6.4.*"
      },
      {
        "status": "unaffected",
        "version": "6.5",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "kernel/trace/ring_buffer.c",
      "kernel/trace/trace.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2023-53718

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30311 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement