Resource Injection Affecting kernel-rt-debug package, versions *
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RHEL7-KERNELRTDEBUG-7078637
- published 23 May 2024
- disclosed 21 May 2024
Introduced: 21 May 2024
CVE-2023-52787 Open this link in a new tabHow to fix?
There is no fixed version for RHEL:7 kernel-rt-debug.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-rt-debug package and not the kernel-rt-debug package as distributed by RHEL.
See How to fix? for RHEL:7 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
blk-mq: make sure active queue usage is held for bio_integrity_prep()
blk_integrity_unregister() can come if queue usage counter isn't held for one bio with integrity prepared, so this request may be completed with calling profile->complete_fn, then kernel panic.
Another constraint is that bio_integrity_prep() needs to be called before bio merge.
Fix the issue by:
call bio_integrity_prep() with one queue usage counter grabbed reliably
call bio_integrity_prep() before bio merge
References
- https://access.redhat.com/security/cve/CVE-2023-52787
- https://git.kernel.org/stable/c/b0077e269f6c152e807fdac90b58caf012cdbaab
- https://git.kernel.org/stable/c/b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9
- https://git.kernel.org/stable/c/b80056bd75a16e4550873ecefe12bc8fd190b1cf
- https://git.kernel.org/stable/c/e9c309ded295b7f8849097d71ae231456ca79f78