Linux: Concurrent Execution using Shared Resource with Improper Synchronization
CVE-2023-52578 is a high-severity concurrent execution using shared resource with improper synchronization vulnerability in Linux, with a CVSS 3.1 base score of 7.0 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions d2346e6beb699909ca455d9d20c4e577ce900839, ad8d39c7b437fcdab7208a6a56c093d222c008d5, 04cc361f029c14dd067ad180525c7392334c9bfd as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.19% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to d2346e6beb699909ca455d9d20c4e577ce900839 or ad8d39c7b437fcdab7208a6a56c093d222c008d5 or 04cc361f029c14dd067ad180525c7392334c9bfd or 8bc97117b51d68d5cea8f5351cca2d8c4153f394, whichever matches your release line, or a later version.
- Update Linux Kernel to 4.19.296 or 5.4.258 or 5.10.198 or 5.15.134, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 1c29fc4989bc2a3838b2837adc12b8aeb0feeede up to, but not including, d2346e6beb699909ca455d9d20c4e577ce900839; 1c29fc4989bc2a3838b2837adc12b8aeb0feeede up to, but not including, ad8d39c7b437fcdab7208a6a56c093d222c008d5; 1c29fc4989bc2a3838b2837adc12b8aeb0feeede up to, but not including, 04cc361f029c14dd067ad180525c7392334c9bfd; 1c29fc4989bc2a3838b2837adc12b8aeb0feeede up to, but not including, 8bc97117b51d68d5cea8f5351cca2d8c4153f394; 1c29fc4989bc2a3838b2837adc12b8aeb0feeede up to, but not including, 89f9f20b1cbd36d99d5a248a4bf8d11d4fd049a2; 1c29fc4989bc2a3838b2837adc12b8aeb0feeede up to, but not including, f2ef4cb4d418fa64fe73eb84d10cc5c0e52e00fa; 1c29fc4989bc2a3838b2837adc12b8aeb0feeede up to, but not including, 44bdb313da57322c9b3c108eb66981c6ec6509f4; 2.6.17 | d2346e6beb699909ca455d9d20c4e577ce900839, ad8d39c7b437fcdab7208a6a56c093d222c008d5, 04cc361f029c14dd067ad180525c7392334c9bfd, 8bc97117b51d68d5cea8f5351cca2d8c4153f394, 89f9f20b1cbd36d99d5a248a4bf8d11d4fd049a2, f2ef4cb4d418fa64fe73eb84d10cc5c0e52e00fa |
| Linux | Linux Kernel | 2.6.17 up to, but not including, 4.19.296; 4.20 up to, but not including, 5.4.258; 5.5 up to, but not including, 5.10.198; 5.11 up to, but not including, 5.15.134; 5.16 up to, but not including, 6.1.56; 6.2 up to, but not including, 6.5.6; 6.6 | 4.19.296, 5.4.258, 5.10.198, 5.15.134, 6.1.56, 6.5.6 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- HighSuccess depends on conditions outside the attacker's control.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
Official description
In the Linux kernel, the following vulnerability has been resolved: net: bridge: use DEV_STATS_INC() syzbot/KCSAN reported data-races in br_handle_frame_finish() [1] This function can run from multiple cpus without mutual exclusion. Adopt SMP safe DEV_STATS_INC() to update dev->stats fields. Handles updates to dev->stats.tx_dropped while we are at it. [1] BUG: KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish read-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 1: br_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189 br_nf_hook_thresh+0x1ed/0x220 br_nf_pre_routing_finish_ipv6+0x50f/0x540 NF_HOOK include/linux/netfilter.h:304 [inline] br_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178 br_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508 nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline] nf_hook_bridge_pre net/bridge/br_input.c:272 [inline] br_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417 __netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417 __netif_receive_skb_one_core net/core/dev.c:5521 [inline] __netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637 process_backlog+0x21f/0x380 net/core/dev.c:5965 __napi_poll+0x60/0x3b0 net/core/dev.c:6527 napi_poll net/core/dev.c:6594 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6727 __do_softirq+0xc1/0x265 kernel/softirq.c:553 run_ksoftirqd+0x17/0x20 kernel/softirq.c:921 smpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164 kthread+0x1d7/0x210 kernel/kthread.c:388 ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 read-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 0: br_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189 br_nf_hook_thresh+0x1ed/0x220 br_nf_pre_routing_finish_ipv6+0x50f/0x540 NF_HOOK include/linux/netfilter.h:304 [inline] br_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178 br_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508 nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline] nf_hook_bridge_pre net/bridge/br_input.c:272 [inline] br_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417 __netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417 __netif_receive_skb_one_core net/core/dev.c:5521 [inline] __netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637 process_backlog+0x21f/0x380 net/core/dev.c:5965 __napi_poll+0x60/0x3b0 net/core/dev.c:6527 napi_poll net/core/dev.c:6594 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6727 __do_softirq+0xc1/0x265 kernel/softirq.c:553 do_softirq+0x5e/0x90 kernel/softirq.c:454 __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_local_purge+0x1a8/0x1f0 net/batman-adv/translation-table.c:1356 batadv_tt_purge+0x2b/0x630 net/batman-adv/translation-table.c:3560 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2703 worker_thread+0x525/0x730 kernel/workqueue.c:2784 kthread+0x1d7/0x210 kernel/kthread.c:388 ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 value changed: 0x00000000000d7190 -> 0x00000000000d7191 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 14848 Comm: kworker/u4:11 Not tainted 6.6.0-rc1-syzkaller-00236-gad8a69f361b9 #0
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Concurrent Execution using Shared Resource with Improper Synchronization
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
How developers prevent this class of flaw
- In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
- Use thread-safe capabilities such as the data access abstraction in Spring.
- Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring. Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/04cc361f029c14dd067ad180525c7392334c9bfd
- git.kernel.org/stable/c/44bdb313da57322c9b3c108eb66981c6ec6509f4
- git.kernel.org/stable/c/89f9f20b1cbd36d99d5a248a4bf8d11d4fd049a2
- git.kernel.org/stable/c/8bc97117b51d68d5cea8f5351cca2d8c4153f394
- git.kernel.org/stable/c/ad8d39c7b437fcdab7208a6a56c093d222c008d5
- git.kernel.org/stable/c/d2346e6beb699909ca455d9d20c4e577ce900839
- git.kernel.org/stable/c/f2ef4cb4d418fa64fe73eb84d10cc5c0e52e00fa
Recent Concurrent Execution using Shared Resource with Improper Synchronization vulnerabilities
- 7.0 High severity
- 8.8 High severity
- 7.0 High severity
- 7.0 High severity
- 7.5 High severity
- 7.4 High severity
Spotted an error? Tell us.