目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2023-52587— Linux kernel安全漏洞

一分钟漏洞结论

影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于 IB/ipoib中的 mcast 列表存在死循环。

AI 预测 4.7 利用难度: 困难 EPSS 0.31% · P22

影响版本矩阵 18

厂商产品 版本范围状态
Linux Linux d2fe937ce6ce23daf5fb214e45432dbb631581b7< 4c8922ae8eb8dcc1e4b7d1059d97a8334288d825 affected
d2fe937ce6ce23daf5fb214e45432dbb631581b7< 615e3adc2042b7be4ad122a043fc9135e6342c90 affected
d2fe937ce6ce23daf5fb214e45432dbb631581b7< ac2630fd3c90ffec34a0bfc4d413668538b0e8f2 affected
d2fe937ce6ce23daf5fb214e45432dbb631581b7< ed790bd0903ed3352ebf7f650d910f49b7319b34 affected
d2fe937ce6ce23daf5fb214e45432dbb631581b7< 5108a2dc2db5630fb6cd58b8be80a0c134bc310a affected
d2fe937ce6ce23daf5fb214e45432dbb631581b7< 342258fb46d66c1b4c7e2c3717ac01e10c03cf18 affected
d2fe937ce6ce23daf5fb214e45432dbb631581b7< 7c7bd4d561e9dc6f5b7df9e184974915f6701a89 affected
d2fe937ce6ce23daf5fb214e45432dbb631581b7< 4f973e211b3b1c6d36f7c6a19239d258856749f9 affected
… +10 条更多
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2023-52587 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
IB/ipoib: Fix mcast list locking
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: IB/ipoib: Fix mcast list locking Releasing the `priv->lock` while iterating the `priv->multicast_list` in `ipoib_mcast_join_task()` opens a window for `ipoib_mcast_dev_flush()` to remove the items while in the middle of iteration. If the mcast is removed while the lock was dropped, the for loop spins forever resulting in a hard lockup (as was reported on RHEL 4.18.0-372.75.1.el8_6 kernel): Task A (kworker/u72:2 below) | Task B (kworker/u72:0 below) -----------------------------------+----------------------------------- ipoib_mcast_join_task(work) | ipoib_ib_dev_flush_light(work) spin_lock_irq(&priv->lock) | __ipoib_ib_dev_flush(priv, ...) list_for_each_entry(mcast, | ipoib_mcast_dev_flush(dev = priv->dev) &priv->multicast_list, list) | ipoib_mcast_join(dev, mcast) | spin_unlock_irq(&priv->lock) | | spin_lock_irqsave(&priv->lock, flags) | list_for_each_entry_safe(mcast, tmcast, | &priv->multicast_list, list) | list_del(&mcast->list); | list_add_tail(&mcast->list, &remove_list) | spin_unlock_irqrestore(&priv->lock, flags) spin_lock_irq(&priv->lock) | | ipoib_mcast_remove_list(&remove_list) (Here, `mcast` is no longer on the | list_for_each_entry_safe(mcast, tmcast, `priv->multicast_list` and we keep | remove_list, list) spinning on the `remove_list` of | >>> wait_for_completion(&mcast->done) the other thread which is blocked | and the list is still valid on | it's stack.) Fix this by keeping the lock held and changing to GFP_ATOMIC to prevent eventual sleeps. Unfortunately we could not reproduce the lockup and confirm this fix but based on the code review I think this fix should address such lockups. crash> bc 31 PID: 747 TASK: ff1c6a1a007e8000 CPU: 31 COMMAND: "kworker/u72:2" -- [exception RIP: ipoib_mcast_join_task+0x1b1] RIP: ffffffffc0944ac1 RSP: ff646f199a8c7e00 RFLAGS: 00000002 RAX: 0000000000000000 RBX: ff1c6a1a04dc82f8 RCX: 0000000000000000 work (&priv->mcast_task{,.work}) RDX: ff1c6a192d60ac68 RSI: 0000000000000286 RDI: ff1c6a1a04dc8000 &mcast->list RBP: ff646f199a8c7e90 R8: ff1c699980019420 R9: ff1c6a1920c9a000 R10: ff646f199a8c7e00 R11: ff1c6a191a7d9800 R12: ff1c6a192d60ac00 mcast R13: ff1c6a1d82200000 R14: ff1c6a1a04dc8000 R15: ff1c6a1a04dc82d8 dev priv (&priv->lock) &priv->multicast_list (aka head) ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 --- <NMI exception stack> --- #5 [ff646f199a8c7e00] ipoib_mcast_join_task+0x1b1 at ffffffffc0944ac1 [ib_ipoib] #6 [ff646f199a8c7e98] process_one_work+0x1a7 at ffffffff9bf10967 crash> rx ff646f199a8c7e68 ff646f199a8c7e68: ff1c6a1a04dc82f8 <<< work = &priv->mcast_task.work crash> list -hO ipoib_dev_priv.multicast_list ff1c6a1a04dc8000 (empty) crash> ipoib_dev_priv.mcast_task.work.func,mcast_mutex.owner.counter ff1c6a1a04dc8000 mcast_task.work.func = 0xffffffffc0944910 <ipoib_mcast_join_task>, mcast_mutex.owner.counter = 0xff1c69998efec000 crash> b 8 PID: 8 TASK: ff1c69998efec000 CPU: 33 COMMAND: "kworker/u72:0" -- #3 [ff646f1980153d50] wait_for_completion+0x96 at ffffffff9c7d7646 #4 [ff646f1980153d90] ipoib_mcast_remove_list+0x56 at ffffffffc0944dc6 [ib_ipoib] #5 [ff646f1980153de8] ipoib_mcast_dev_flush+0x1a7 at ffffffffc09455a7 [ib_ipoib] #6 [ff646f1980153e58] __ipoib_ib_dev_flush+0x1a4 at ffffffffc09431a4 [ib_ipoib] #7 [ff ---truncated---
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于 IB/ipoib中的 mcast 列表存在死循环。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD

受影响产品

厂商 产品 影响版本 CPE 订阅
Linux Linux d2fe937ce6ce23daf5fb214e45432dbb631581b7 ~ 4c8922ae8eb8dcc1e4b7d1059d97a8334288d825 -
Linux Linux 4.1 -

二、漏洞 CVE-2023-52587 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2023-52587 的情报信息

请登录查看更多情报信息。

CVE-2023-52587 邮件列表归档 (2)

CVE-2023-52587 其他参考 (8)

同批安全公告 · Linux · 2024-03-06 · 共 27 条

CVE-2024-26623 7.8 HIGH Linux kernel 安全漏洞
CVE-2023-52601 7.8 HIGH Linux kernel 安全漏洞
CVE-2023-52600 7.8 HIGH Linux kernel 安全漏洞
CVE-2023-52599 7.8 HIGH Linux kernel 安全漏洞
CVE-2023-52602 7.8 HIGH Linux kernel 安全漏洞
CVE-2023-52603 7.8 HIGH Linux kernel安全漏洞
CVE-2023-52604 7.8 HIGH Linux kernel 安全漏洞
CVE-2023-52606 7.8 HIGH Linux kernel 安全漏洞
CVE-2023-52591 7.8 HIGH Linux kernel安全漏洞
CVE-2023-52590 7.8 HIGH Linux kernel安全漏洞
CVE-2024-26625 7.8 HIGH Linux kernel安全漏洞
CVE-2023-52586 7.8 HIGH Linux kernel 安全漏洞
CVE-2024-26626 7.5 HIGH Linux kernel 安全漏洞
CVE-2023-52588 7.3 HIGH Linux kernel 安全漏洞
CVE-2023-52598 Linux kernel 安全漏洞
CVE-2023-52607 Linux kernel 安全漏洞
CVE-2024-26627 Linux kernel 安全漏洞
CVE-2023-52583 Linux kernel 安全漏洞
CVE-2023-52597 Linux kernel 安全漏洞
CVE-2023-52596 Linux kernel 安全漏洞

显示前 20 条，共 27 条。 查看全部 &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2023-52587

暂无评论

发表评论