// For flags

CVE-2023-52836

locking/ww_mutex/test: Fix potential workqueue corruption

Severity Score

"-"
*CVSS v-

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

In the Linux kernel, the following vulnerability has been resolved:

locking/ww_mutex/test: Fix potential workqueue corruption

In some cases running with the test-ww_mutex code, I was seeing
odd behavior where sometimes it seemed flush_workqueue was
returning before all the work threads were finished.

Often this would cause strange crashes as the mutexes would be
freed while they were being used.

Looking at the code, there is a lifetime problem as the
controlling thread that spawns the work allocates the
"struct stress" structures that are passed to the workqueue
threads. Then when the workqueue threads are finished,
they free the stress struct that was passed to them.

Unfortunately the workqueue work_struct node is in the stress
struct. Which means the work_struct is freed before the work
thread returns and while flush_workqueue is waiting.

It seems like a better idea to have the controlling thread
both allocate and free the stress structures, so that we can
be sure we don't corrupt the workqueue by freeing the structure
prematurely.

So this patch reworks the test to do so, and with this change
I no longer see the early flush_workqueue returns.

En el kernel de Linux, se resolvió la siguiente vulnerabilidad: lock/ww_mutex/test: soluciona una posible corrupción de la cola de trabajo. En algunos casos, al ejecutar el código test-ww_mutex, veía un comportamiento extraño en el que a veces parecía que flush_workqueue regresaba antes que todos los subprocesos de trabajo. hemos terminado. A menudo, esto causaría fallas extrañas ya que los mutex se liberarían mientras se estaban usando. Al observar el código, hay un problema de duración, ya que el subproceso de control que genera el trabajo asigna las estructuras de "estrés de estructura" que se pasan a los subprocesos de la cola de trabajo. Luego, cuando los subprocesos de la cola de trabajo finalizan, liberan la estructura de tensión que se les pasó. Desafortunadamente, el nodo work_struct de la cola de trabajo está en la estructura de estrés. Lo que significa que work_struct se libera antes de que regrese el hilo de trabajo y mientras descarga_workqueue está esperando. Parece una mejor idea que el subproceso de control asigne y libere las estructuras de tensión, de modo que podamos estar seguros de no corromper la cola de trabajo al liberar la estructura prematuramente. Entonces, este parche reelabora la prueba para hacerlo, y con este cambio ya no veo los primeros retornos de Flush_workqueue.

*Credits: N/A
CVSS Scores
Attack Vector
-
Attack Complexity
-
Privileges Required
-
User Interaction
-
Scope
-
Confidentiality
-
Integrity
-
Availability
-
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-05-21 CVE Reserved
  • 2024-05-21 CVE Published
  • 2024-05-22 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
< 4.14.331
Search vendor "Linux" for product "Linux Kernel" and version " < 4.14.331"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
< 4.19.300
Search vendor "Linux" for product "Linux Kernel" and version " < 4.19.300"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
< 5.4.262
Search vendor "Linux" for product "Linux Kernel" and version " < 5.4.262"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
< 5.10.202
Search vendor "Linux" for product "Linux Kernel" and version " < 5.10.202"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
< 5.15.140
Search vendor "Linux" for product "Linux Kernel" and version " < 5.15.140"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
< 6.1.64
Search vendor "Linux" for product "Linux Kernel" and version " < 6.1.64"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
< 6.5.13
Search vendor "Linux" for product "Linux Kernel" and version " < 6.5.13"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
< 6.6.3
Search vendor "Linux" for product "Linux Kernel" and version " < 6.6.3"
en
Affected
Linux
Search vendor "Linux"
Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
< 6.7
Search vendor "Linux" for product "Linux Kernel" and version " < 6.7"
en
Affected