Heimdall Security Logo

CVE-2023-53608

Vulnérabilité élevée dans Linux (Linux)

CVSS 7.8 · Élevée
EPSS 0.1%
Linux•Linux•Versions : 6.2.11, <=6.1.*, 4.19.281, 5.15.107, 0, 6.1.24, <=5.10.*, 2.6.30, <=4.14.*, <034cce77d52ba013ce62b4f5258c29907eb1ada5, 6.3, 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453, <6be49d100c22ffea3287a4b19d7639d259888e33, <613bf23c070d11c525268f2945aa594704a9b764, <92684e02654c91a61a0b0561433b710bcece19fe, <=5.4.*, <2.6.30, <=4.19.*, <b4d80bd6370b81a1725b6b8f7894802c23a14e9f, <=6.2.*, 4.14.313, 5.4.241, <0dbf0e64b91ee8fcb278aea93eb06fc7d56ecbcc, <bae009a2f1b7c2011d2e92d8c84868d315c0b97e, <=*, <=5.15.*, 5.10.178, <f32297dba338dc06d62286dedb3cdbd5175b1719

Description

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() The finalization of nilfs_segctor_thread() can race with nilfs_segctor_kill_thread() which terminates that thread, potentially causing a use-after-free BUG as KASAN detected. At the end of nilfs_segctor_thread(), it assigns NULL to "sc_task" member of "struct nilfs_sc_info" to indicate the thread has finished, and then notifies nilfs_segctor_kill_thread() of this using waitqueue "sc_wait_task" on the struct nilfs_sc_info. However, here, immediately after the NULL assignment to "sc_task", it is possible that nilfs_segctor_kill_thread() will detect it and return to continue the deallocation, freeing the nilfs_sc_info structure before the thread does the notification. This fixes the issue by protecting the NULL assignment to "sc_task" and its notification, with spinlock "sc_state_lock" of the struct nilfs_sc_info. Since nilfs_segctor_kill_thread() does a final check to see if "sc_task" is NULL with "sc_state_lock" locked, this can eliminate the race.

Gravité et risque d'exploitation

CVE-2023-53608 obtient un score CVSS de 7.8/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.15 %, ce qui la place devant 3.7 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions 6.2.11, <=6.1.*, 4.19.281, 5.15.107, 0, 6.1.24, <=5.10.*, 2.6.30, <=4.14.*, <034cce77d52ba013ce62b4f5258c29907eb1ada5, 6.3, 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453, <6be49d100c22ffea3287a4b19d7639d259888e33, <613bf23c070d11c525268f2945aa594704a9b764, <92684e02654c91a61a0b0561433b710bcece19fe, <=5.4.*, <2.6.30, <=4.19.*, <b4d80bd6370b81a1725b6b8f7894802c23a14e9f, <=6.2.*, 4.14.313, 5.4.241, <0dbf0e64b91ee8fcb278aea93eb06fc7d56ecbcc, <bae009a2f1b7c2011d2e92d8c84868d315c0b97e, <=*, <=5.15.*, 5.10.178, <f32297dba338dc06d62286dedb3cdbd5175b1719) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE