CVE-2023-52854 Affecting kernel-default-livepatch-devel package, versions <5.3.18-150200.24.203.1


Severity

Recommended
0.0
medium
0
10

Based on SUSE Linux Enterprise Server security rating.

Threat Intelligence

EPSS
0.04% (13th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES152-KERNELDEFAULTLIVEPATCHDEVEL-8136578
  • published1 Oct 2024
  • disclosed30 Sept 2024

Introduced: 30 Sep 2024

CVE-2023-52854  (opens in a new tab)

How to fix?

Upgrade SLES:15.2 kernel-default-livepatch-devel to version 5.3.18-150200.24.203.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-default-livepatch-devel package and not the kernel-default-livepatch-devel package as distributed by SLES. See How to fix? for SLES:15.2 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

padata: Fix refcnt handling in padata_free_shell()

In a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead to system UAF (Use-After-Free) issues. Due to the lengthy analysis of the pcrypt_aead01 function call, I'll describe the problem scenario using a simplified model:

Suppose there's a user of padata named user_function that adheres to the padata requirement of calling padata_free_shell after serial() has been invoked, as demonstrated in the following code:

struct request {
    struct padata_priv padata;
    struct completion *done;
};

void parallel(struct padata_priv *padata) { do_something(); }

void serial(struct padata_priv *padata) { struct request *request = container_of(padata, struct request, padata); complete(request-&gt;done); }

void user_function() { DECLARE_COMPLETION(done) padata-&gt;parallel = parallel; padata-&gt;serial = serial; padata_do_parallel(); wait_for_completion(&amp;done); padata_free_shell(); }

In the corresponding padata.c file, there's the following code:

static void padata_serial_worker(struct work_struct *serial_work) {
    ...
    cnt = 0;

while (!list_empty(&amp;amp;local_list)) {
    ...
    padata-&amp;gt;serial(padata);
    cnt++;
}

local_bh_enable();

if (refcount_sub_and_test(cnt, &amp;amp;pd-&amp;gt;refcnt))
    padata_free_pd(pd);

}

Because of the high system load and the accumulation of unexecuted softirq at this moment, local_bh_enable() in padata takes longer to execute than usual. Subsequently, when accessing pd-&gt;refcnt, pd has already been released by padata_free_shell(), resulting in a UAF issue with pd-&gt;refcnt.

The fix is straightforward: add refcount_dec_and_test before calling padata_free_pd in padata_free_shell.

CVSS Scores

version 3.1