linux-cve-announce - CVE-2023-53210: md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091511-CVE-2023-53210-0e06@gregkh>
Date: Mon, 15 Sep 2025 16:21:44 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53210: md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid()

r5l_flush_stripe_to_raid() will check if the list 'flushing_ios' is
empty, and then submit 'flush_bio', however, r5l_log_flush_endio()
is clearing the list first and then clear the bio, which will cause
null-ptr-deref:

T1: submit flush io
raid5d
 handle_active_stripes
  r5l_flush_stripe_to_raid
   // list is empty
   // add 'io_end_ios' to the list
   bio_init
   submit_bio
   // io1

T2: io1 is done
r5l_log_flush_endio
 list_splice_tail_init
 // clear the list
			T3: submit new flush io
			...
			r5l_flush_stripe_to_raid
			 // list is empty
			 // add 'io_end_ios' to the list
			 bio_init
 bio_uninit
 // clear bio->bi_blkg
			 submit_bio
			 // null-ptr-deref

Fix this problem by clearing bio before clearing the list in
r5l_log_flush_endio().

The Linux kernel CVE team has assigned CVE-2023-53210 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.18 with commit 0dd00cba99c352dc9afd62979f350d808c215cb9 and fixed in 6.1.53 with commit 711fb92606208a8626b785da4f9f23d648a5b6c8
	Issue introduced in 5.18 with commit 0dd00cba99c352dc9afd62979f350d808c215cb9 and fixed in 6.4.16 with commit 7a8b6d93991bf4b72b3f959baea35397c6c8e521
	Issue introduced in 5.18 with commit 0dd00cba99c352dc9afd62979f350d808c215cb9 and fixed in 6.5.3 with commit e46b2e7be8059d156af8c011dd8d665229b65886
	Issue introduced in 5.18 with commit 0dd00cba99c352dc9afd62979f350d808c215cb9 and fixed in 6.6 with commit 0d0bd28c500173bfca78aa840f8f36d261ef1765

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53210
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/md/raid5-cache.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/711fb92606208a8626b785da4f9f23d648a5b6c8
	https://git.kernel.org/stable/c/7a8b6d93991bf4b72b3f959baea35397c6c8e521
	https://git.kernel.org/stable/c/e46b2e7be8059d156af8c011dd8d665229b65886
	https://git.kernel.org/stable/c/0d0bd28c500173bfca78aa840f8f36d261ef1765