linux-cve-announce - CVE-2023-52583: ceph: fix deadlock or deadcode of misusing dget()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024030641-CVE-2023-52583-fd38@gregkh>
Date: Wed,  6 Mar 2024 06:45:41 +0000
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2023-52583: ceph: fix deadlock or deadcode of misusing dget()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix deadlock or deadcode of misusing dget()

The lock order is incorrect between denty and its parent, we should
always make sure that the parent get the lock first.

But since this deadcode is never used and the parent dir will always
be set from the callers, let's just remove it.

The Linux kernel CVE team has assigned CVE-2023-52583 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.19.307 with commit eb55ba8aa7fb
	Fixed in 5.4.269 with commit 6ab4fd508fad
	Fixed in 5.10.210 with commit e016e358461b
	Fixed in 5.15.149 with commit a9c15d6e8aee
	Fixed in 6.1.77 with commit 7f2649c94264
	Fixed in 6.6.16 with commit 196b87e5c00c
	Fixed in 6.7.4 with commit 76cb2aa3421f
	Fixed in 6.8-rc1 with commit b493ad718b1f

Please see https://www.kernel.org or a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52583
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/ceph/caps.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/eb55ba8aa7fb7aad54f40fbf4d8dcdfdba0bebf6
	https://git.kernel.org/stable/c/6ab4fd508fad942f1f1ba940492f2735e078e980
	https://git.kernel.org/stable/c/e016e358461b89b231626fcf78c5c38e35c44fd3
	https://git.kernel.org/stable/c/a9c15d6e8aee074fae66c04d114f20b84274fcca
	https://git.kernel.org/stable/c/7f2649c94264d00df6b6ac27161e9f4372a3450e
	https://git.kernel.org/stable/c/196b87e5c00ce021e164a5de0f0d04f4116a9160
	https://git.kernel.org/stable/c/76cb2aa3421fee4fde706dec41b1344bc0a9ad67
	https://git.kernel.org/stable/c/b493ad718b1f0357394d2cdecbf00a44a36fa085