linux-cve-announce - CVE-2023-52672: pipe: wakeup wr_wait after setting max

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024051729-CVE-2023-52672-f30c@gregkh>
Date: Fri, 17 May 2024 16:01:33 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2023-52672: pipe: wakeup wr_wait after setting max_usage

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

pipe: wakeup wr_wait after setting max_usage

Commit c73be61cede5 ("pipe: Add general notification queue support") a
regression was introduced that would lock up resized pipes under certain
conditions. See the reproducer in [1].

The commit resizing the pipe ring size was moved to a different
function, doing that moved the wakeup for pipe->wr_wait before actually
raising pipe->max_usage. If a pipe was full before the resize occured it
would result in the wakeup never actually triggering pipe_write.

Set @max_usage and @nr_accounted before waking writers if this isn't a
watch queue.

[Christian Brauner <brauner@...nel.org>: rewrite to account for watch queues]

The Linux kernel CVE team has assigned CVE-2023-52672 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.8 with commit c73be61cede5 and fixed in 5.10.210 with commit 162ae0e78bda
	Issue introduced in 5.8 with commit c73be61cede5 and fixed in 5.15.149 with commit 3efbd114b915
	Issue introduced in 5.8 with commit c73be61cede5 and fixed in 6.1.76 with commit b87a1229d866
	Issue introduced in 5.8 with commit c73be61cede5 and fixed in 6.6.15 with commit 68e51bdb1194
	Issue introduced in 5.8 with commit c73be61cede5 and fixed in 6.7.3 with commit 6fb70694f8d1
	Issue introduced in 5.8 with commit c73be61cede5 and fixed in 6.8 with commit e95aada4cb93

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52672
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/pipe.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/162ae0e78bdabf84ef10c1293c4ed7865cb7d3c8
	https://git.kernel.org/stable/c/3efbd114b91525bb095b8ae046382197d92126b9
	https://git.kernel.org/stable/c/b87a1229d8668fbc78ebd9ca0fc797a76001c60f
	https://git.kernel.org/stable/c/68e51bdb1194f11d3452525b99c98aff6f837b24
	https://git.kernel.org/stable/c/6fb70694f8d1ac34e45246b0ac988f025e1e5b55
	https://git.kernel.org/stable/c/e95aada4cb93d42e25c30a0ef9eb2923d9711d4a