linux-cve-announce - CVE-2023-54209: block: fix blktrace debugfs entries leakage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025123023-CVE-2023-54209-39be@gregkh>
Date: Tue, 30 Dec 2025 13:13:39 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-54209: block: fix blktrace debugfs entries leakage

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

block: fix blktrace debugfs entries leakage

Commit 99d055b4fd4b ("block: remove per-disk debugfs files in
blk_unregister_queue") moves blk_trace_shutdown() from
blk_release_queue() to blk_unregister_queue(), this is safe if blktrace
is created through sysfs, however, there is a regression in corner
case.

blktrace can still be enabled after del_gendisk() through ioctl if
the disk is opened before del_gendisk(), and if blktrace is not shutdown
through ioctl before closing the disk, debugfs entries will be leaked.

Fix this problem by shutdown blktrace in disk_release(), this is safe
because blk_trace_remove() is reentrant.

The Linux kernel CVE team has assigned CVE-2023-54209 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.19 with commit 99d055b4fd4bbb309c6cdb51a0d420669f777944 and fixed in 6.1.39 with commit aa07e56c6a9c7558165690d14eed4fe8babf34fb
	Issue introduced in 5.19 with commit 99d055b4fd4bbb309c6cdb51a0d420669f777944 and fixed in 6.3.13 with commit 7149e57cf01184fba175589f8fbe9fbf33be02e1
	Issue introduced in 5.19 with commit 99d055b4fd4bbb309c6cdb51a0d420669f777944 and fixed in 6.4.4 with commit 942e81650b81b4ca62f1d8c61de455c9e7c7e6ca
	Issue introduced in 5.19 with commit 99d055b4fd4bbb309c6cdb51a0d420669f777944 and fixed in 6.5 with commit dd7de3704af9989b780693d51eaea49a665bd9c2

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-54209
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	block/genhd.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/aa07e56c6a9c7558165690d14eed4fe8babf34fb
	https://git.kernel.org/stable/c/7149e57cf01184fba175589f8fbe9fbf33be02e1
	https://git.kernel.org/stable/c/942e81650b81b4ca62f1d8c61de455c9e7c7e6ca
	https://git.kernel.org/stable/c/dd7de3704af9989b780693d51eaea49a665bd9c2