linux-cve-announce - CVE-2023-52699: sysv: don't call sb_bread() with pointers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024051910-CVE-2023-52699-4099@gregkh>
Date: Sun, 19 May 2024 12:11:11 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2023-52699: sysv: don't call sb_bread() with pointers_lock held

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

sysv: don't call sb_bread() with pointers_lock held

syzbot is reporting sleep in atomic context in SysV filesystem [1], for
sb_bread() is called with rw_spinlock held.

A "write_lock(&pointers_lock) => read_lock(&pointers_lock) deadlock" bug
and a "sb_bread() with write_lock(&pointers_lock)" bug were introduced by
"Replace BKL for chain locking with sysvfs-private rwlock" in Linux 2.5.12.

Then, "[PATCH] err1-40: sysvfs locking fix" in Linux 2.6.8 fixed the
former bug by moving pointers_lock lock to the callers, but instead
introduced a "sb_bread() with read_lock(&pointers_lock)" bug (which made
this problem easier to hit).

Al Viro suggested that why not to do like get_branch()/get_block()/
find_shared() in Minix filesystem does. And doing like that is almost a
revert of "[PATCH] err1-40: sysvfs locking fix" except that get_branch()
 from with find_shared() is called without write_lock(&pointers_lock).

The Linux kernel CVE team has assigned CVE-2023-52699 to this issue.

Affected and fixed versions
===========================

	Fixed in 4.19.312 with commit 13b33feb2ebd
	Fixed in 5.4.274 with commit 1b4fe801b5be
	Fixed in 5.10.215 with commit 674c1c4229e7
	Fixed in 5.15.155 with commit fd203d2c671b
	Fixed in 6.1.86 with commit 53cb1e52c9db
	Fixed in 6.6.27 with commit 89e8524135a3
	Fixed in 6.8.6 with commit a69224223746
	Fixed in 6.9 with commit f123dc86388c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52699
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	fs/sysv/itree.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/13b33feb2ebddc2b1aa607f553566b18a4af1d76
	https://git.kernel.org/stable/c/1b4fe801b5bedec2b622ddb18e5c9bf26c63d79f
	https://git.kernel.org/stable/c/674c1c4229e743070e09db63a23442950ff000d1
	https://git.kernel.org/stable/c/fd203d2c671bdee9ab77090ff394d3b71b627927
	https://git.kernel.org/stable/c/53cb1e52c9db618c08335984d1ca80db220ccf09
	https://git.kernel.org/stable/c/89e8524135a3902e7563a5a59b7b5ec1bf4904ac
	https://git.kernel.org/stable/c/a69224223746ab96d43e5db9d22d136827b7e2d3
	https://git.kernel.org/stable/c/f123dc86388cb669c3d6322702dc441abc35c31e