CVE-2023-2269: Medium severity linux kernel vulnerability
A bug in the Linux kernel version 6.2.0 by syzkaller with our own templates. The bug causes a possible recursive locking scenario, resulting in a deadlock.
The key trace is as follows:
downread+0x9d/0x450 kernel/locking/rwsem.c:1509 dmgetinactivetable+0x2b/0xc0 drivers/md/dm-ioctl.c:773 devstatus+0x4fd/0x7c0 drivers/md/dm-ioctl.c:844 tableclear+0x197/0x280 drivers/md/dm-ioctl.c:1537
In tableclear, it acquires a write lock https://elixir.bootlin.com/linux/v6.2/source/drivers/md/dm-ioctl.c#L1520 downwrite(&hashlock);
Then before the lock is released at L1539, there is a path shown above: tableclear -> devstatus -> dmgetinactivetable -> downread
https://elixir.bootlin.com/linux/v6.2/source/drivers/md/dm-ioctl.c#L773 downread(&hashlock);
It tries to acquire the same read lock again, resulting in the deadlock problem
Other sources
A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in tableclear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component.
— Launchpad
Linux Kernel is vulnerable to a denial of service, caused by a deadlock in the tableclear function in the Device Mapper-Multipathing sub-component in drivers/md/dm-ioctl.c. By sending a specially crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2269?
CVE-2023-2269 is classified as a moderate severity vulnerability due to the possibility of causing a deadlock in the Linux kernel.
How do I fix CVE-2023-2269?
To fix CVE-2023-2269, upgrade to a patched version of the Linux kernel such as 5.10.223-1 or later.
Which versions of Linux are affected by CVE-2023-2269?
CVE-2023-2269 affects Linux kernel version 6.2 and specific versions of Fedora and Debian.
What can happen if CVE-2023-2269 is exploited?
Exploitation of CVE-2023-2269 can lead to a system deadlock, rendering the system unresponsive.
Is there a workaround for CVE-2023-2269?
There is no known workaround for CVE-2023-2269; the best mitigation is to apply the available updates.