CVE-2023-52787 Affecting cluster-md-kmp-default package, versions <6.4.0-150600.23.14.2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-SLES156-CLUSTERMDKMPDEFAULT-7549326
- published 23 Jul 2024
- disclosed 22 Jul 2024
Introduced: 22 Jul 2024
CVE-2023-52787 Open this link in a new tabHow to fix?
Upgrade SLES:15.6 cluster-md-kmp-default to version 6.4.0-150600.23.14.2 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream cluster-md-kmp-default package and not the cluster-md-kmp-default package as distributed by SLES.
See How to fix? for SLES:15.6 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
blk-mq: make sure active queue usage is held for bio_integrity_prep()
blk_integrity_unregister() can come if queue usage counter isn't held for one bio with integrity prepared, so this request may be completed with calling profile->complete_fn, then kernel panic.
Another constraint is that bio_integrity_prep() needs to be called before bio merge.
Fix the issue by:
call bio_integrity_prep() with one queue usage counter grabbed reliably
call bio_integrity_prep() before bio merge
References
- https://www.suse.com/security/cve/CVE-2023-52787.html
- https://bugzilla.suse.com/1225105
- https://git.kernel.org/stable/c/b0077e269f6c152e807fdac90b58caf012cdbaab
- https://git.kernel.org/stable/c/b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9
- https://git.kernel.org/stable/c/b80056bd75a16e4550873ecefe12bc8fd190b1cf
- https://git.kernel.org/stable/c/e9c309ded295b7f8849097d71ae231456ca79f78