cve-2023-52771
Vulnerability from cvelistv5
Published
2024-05-21 15:30
Modified
2024-08-02 23:11
Severity
Summary
cxl/port: Fix delete_endpoint() vs parent unregistration race
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/37179fcc916bce8c3cc7b36d67ef814cce55142b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6b2e428e673b3f55965674a426c40922e91388aa
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8d2ad999ca3c64cb08cf6a58d227b9d9e746d708
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52771",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-29T18:49:27.742644Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:23:44.790Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:35.152Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/37179fcc916bce8c3cc7b36d67ef814cce55142b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6b2e428e673b3f55965674a426c40922e91388aa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8d2ad999ca3c64cb08cf6a58d227b9d9e746d708"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/port.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "37179fcc916b",
              "status": "affected",
              "version": "8dd2bc0f8e02",
              "versionType": "git"
            },
            {
              "lessThan": "6b2e428e673b",
              "status": "affected",
              "version": "8dd2bc0f8e02",
              "versionType": "git"
            },
            {
              "lessThan": "8d2ad999ca3c",
              "status": "affected",
              "version": "8dd2bc0f8e02",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/port.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.13",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.3",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.7",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/port: Fix delete_endpoint() vs parent unregistration race\n\nThe CXL subsystem, at cxl_mem -\u003eprobe() time, establishes a lineage of\nports (struct cxl_port objects) between an endpoint and the root of a\nCXL topology. Each port including the endpoint port is attached to the\ncxl_port driver.\n\nGiven that setup, it follows that when either any port in that lineage\ngoes through a cxl_port -\u003eremove() event, or the memdev goes through a\ncxl_mem -\u003eremove() event. The hierarchy below the removed port, or the\nentire hierarchy if the memdev is removed needs to come down.\n\nThe delete_endpoint() callback is careful to check whether it is being\ncalled to tear down the hierarchy, or if it is only being called to\nteardown the memdev because an ancestor port is going through\n-\u003eremove().\n\nThat care needs to take the device_lock() of the endpoint\u0027s parent.\nWhich requires 2 bugs to be fixed:\n\n1/ A reference on the parent is needed to prevent use-after-free\n   scenarios like this signature:\n\n    BUG: spinlock bad magic on CPU#0, kworker/u56:0/11\n    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230524-3.fc38 05/24/2023\n    Workqueue: cxl_port detach_memdev [cxl_core]\n    RIP: 0010:spin_bug+0x65/0xa0\n    Call Trace:\n      do_raw_spin_lock+0x69/0xa0\n     __mutex_lock+0x695/0xb80\n     delete_endpoint+0xad/0x150 [cxl_core]\n     devres_release_all+0xb8/0x110\n     device_unbind_cleanup+0xe/0x70\n     device_release_driver_internal+0x1d2/0x210\n     detach_memdev+0x15/0x20 [cxl_core]\n     process_one_work+0x1e3/0x4c0\n     worker_thread+0x1dd/0x3d0\n\n2/ In the case of RCH topologies, the parent device that needs to be\n   locked is not always @port-\u003edev as returned by cxl_mem_find_port(), use\n   endpoint-\u003edev.parent instead."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:17:04.207Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/37179fcc916bce8c3cc7b36d67ef814cce55142b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b2e428e673b3f55965674a426c40922e91388aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d2ad999ca3c64cb08cf6a58d227b9d9e746d708"
        }
      ],
      "title": "cxl/port: Fix delete_endpoint() vs parent unregistration race",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52771",
    "datePublished": "2024-05-21T15:30:53.629Z",
    "dateReserved": "2024-05-21T15:19:24.239Z",
    "dateUpdated": "2024-08-02T23:11:35.152Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52771\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T16:15:16.323\",\"lastModified\":\"2024-05-21T16:53:56.550\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncxl/port: Fix delete_endpoint() vs parent unregistration race\\n\\nThe CXL subsystem, at cxl_mem -\u003eprobe() time, establishes a lineage of\\nports (struct cxl_port objects) between an endpoint and the root of a\\nCXL topology. Each port including the endpoint port is attached to the\\ncxl_port driver.\\n\\nGiven that setup, it follows that when either any port in that lineage\\ngoes through a cxl_port -\u003eremove() event, or the memdev goes through a\\ncxl_mem -\u003eremove() event. The hierarchy below the removed port, or the\\nentire hierarchy if the memdev is removed needs to come down.\\n\\nThe delete_endpoint() callback is careful to check whether it is being\\ncalled to tear down the hierarchy, or if it is only being called to\\nteardown the memdev because an ancestor port is going through\\n-\u003eremove().\\n\\nThat care needs to take the device_lock() of the endpoint\u0027s parent.\\nWhich requires 2 bugs to be fixed:\\n\\n1/ A reference on the parent is needed to prevent use-after-free\\n   scenarios like this signature:\\n\\n    BUG: spinlock bad magic on CPU#0, kworker/u56:0/11\\n    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230524-3.fc38 05/24/2023\\n    Workqueue: cxl_port detach_memdev [cxl_core]\\n    RIP: 0010:spin_bug+0x65/0xa0\\n    Call Trace:\\n      do_raw_spin_lock+0x69/0xa0\\n     __mutex_lock+0x695/0xb80\\n     delete_endpoint+0xad/0x150 [cxl_core]\\n     devres_release_all+0xb8/0x110\\n     device_unbind_cleanup+0xe/0x70\\n     device_release_driver_internal+0x1d2/0x210\\n     detach_memdev+0x15/0x20 [cxl_core]\\n     process_one_work+0x1e3/0x4c0\\n     worker_thread+0x1dd/0x3d0\\n\\n2/ In the case of RCH topologies, the parent device that needs to be\\n   locked is not always @port-\u003edev as returned by cxl_mem_find_port(), use\\n   endpoint-\u003edev.parent instead.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cxl/port: corrige delete_endpoint() frente a la ejecuci\u00f3n de cancelaci\u00f3n del registro principal. El subsistema CXL, en el momento cxl_mem -\u0026gt;probe(), establece un linaje de puertos (objetos struct cxl_port) entre un punto final y la ra\u00edz de una topolog\u00eda CXL. Cada puerto, incluido el puerto del punto final, est\u00e1 conectado al controlador cxl_port. Dada esa configuraci\u00f3n, se deduce que cuando cualquier puerto en ese linaje pasa por un evento cxl_port -\u0026gt;remove(), o el memdev pasa por un evento cxl_mem -\u0026gt;remove(). La jerarqu\u00eda debajo del puerto eliminado, o toda la jerarqu\u00eda si se elimina el memdev, debe bajar. La devoluci\u00f3n de llamada delete_endpoint() tiene cuidado de verificar si se llama para derribar la jerarqu\u00eda o si solo se llama para derribar memdev porque un puerto ancestro est\u00e1 pasando por -\u0026gt;remove(). Ese cuidado debe tenerse en cuenta con el dispositivo_lock() del padre del punto final. Lo que requiere la correcci\u00f3n de 2 errores: 1/ Se necesita una referencia en el padre para evitar escenarios de use after free como esta firma: ERROR: spinlock bad magic en CPU#0, kworker/u56:0/11 Nombre del hardware: QEMU PC est\u00e1ndar (Q35 + ICH9, 2009), BIOS edk2-20230524-3.fc38 24/05/2023 Cola de trabajo: cxl_port detach_memdev [cxl_core] RIP: 0010:spin_bug+0x65/0xa0 Seguimiento de llamadas: do_raw_spin_lock+0x69/0xa0 5 /0xb80 delete_endpoint+0xad/0x150 [cxl_core] devres_release_all+0xb8/0x110 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1d2/0x210 detach_memdev+0x15/0x20 [cxl_core] proceso_one_work+0x1e3/0x4c0 _thread+0x1dd/0x3d0 2/ En el caso de RCH topolog\u00edas, el dispositivo principal que debe bloquearse no siempre es @port-\u0026gt;dev como lo devuelve cxl_mem_find_port(); utilice endpoint-\u0026gt;dev.parent en su lugar.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/37179fcc916bce8c3cc7b36d67ef814cce55142b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6b2e428e673b3f55965674a426c40922e91388aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8d2ad999ca3c64cb08cf6a58d227b9d9e746d708\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.