CVE-2023-31084: Medium severity Linux Linux kernel vulnerability
A flaw in the Linux Kernel found in drivers/media/dvb-core/dvbfrontend.c. There is a blocking operation when a task is in !TASKRUNNING. In dvbfrontendgetevent, waiteventinterruptible is called; the condition is dvbfrontendtestevent(fepriv,events). In dvbfrontendtestevent, down(&fepriv->sem) is called. However, waiteventinterruptible would put the process to sleep, and down(&fepriv->sem) may block the process.
Reference: https://lore.kernel.org/all/CA+UBctCu7fXn4q41O3=id1+OdyQ85tZY1x+TkT-6OVBL6KAUw@mail.gmail.com/
Other sources
An issue was discovered in drivers/media/dvb-core/dvbfrontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASKRUNNING. In dvbfrontendgetevent waiteventinterruptible is called; the condition is dvbfrontendtestevent(feprivevents). In dvbfrontendtestevent down(&fepriv->sem) is called. However waiteventinterruptible would put the process to sleep and down(&fepriv->sem) may block the process.
— Microsoft
An issue was discovered in drivers/media/dvb-core/dvbfrontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASKRUNNING. In dvbfrontendgetevent, waiteventinterruptible is called; the condition is dvbfrontendtestevent(fepriv,events). In dvbfrontendtestevent, down(&fepriv->sem) is called. However, waiteventinterruptible would put the process to sleep, and down(&fepriv->sem) may block the process.
— Launchpad
Linux Kernel is vulnerable to a denial of service, caused by a blocking operation when a task is in !TASKRUNNING. In dvbfrontendgetevent, waiteventinterruptible is called in drivers/media/dvb-core/dvbfrontend.c. By sending a specially crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-31084?
CVE-2023-31084 has a medium severity level due to its potential impact on system stability.
How do I fix CVE-2023-31084?
To fix CVE-2023-31084, update the Linux Kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, or newer versions provided by your distribution.
Which software components are affected by CVE-2023-31084?
CVE-2023-31084 affects the Linux Kernel version 6.2 and IBM Security Verify Governance, Identity Manager up to version 10.0.2.
What systems are impacted by CVE-2023-31084?
CVE-2023-31084 impacts systems running Linux Kernel 6.2, Debian distributions, and Fedora versions 37 and 38.
Is there a workaround for CVE-2023-31084?
Currently, there are no known workarounds for CVE-2023-31084 other than applying the available updates.