CVE-2023-52813: crypto: pcrypt - Fix hungtask for PADATA_RESET
In the Linux kernel, the following vulnerability has been resolved:
crypto: pcrypt - Fix hungtask for PADATARESET
The Linux kernel CVE team has assigned CVE-2023-52813 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052103-CVE-2023-52813-0704@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
crypto: pcrypt - Fix hungtask for PADATARESET
We found a hungtask bug in testaeadveccfg as follows:
INFO: task cryptomgrtest:391009 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hungtasktimeoutsecs" disables this message. Call trace: switchto+0x98/0xe0 schedule+0x6c4/0xf40 schedule+0xd8/0x1b4 scheduletimeout+0x474/0x560 waitforcommon+0x368/0x4e0 waitforcompletion+0x20/0x30 waitforcompletion+0x20/0x30 testaeadveccfg+0xab4/0xd50 testaead+0x144/0x1f0 algtestaead+0xd8/0x1e0 algtest+0x634/0x890 cryptomgrtest+0x40/0x70 kthread+0x1e0/0x220 retfromfork+0x10/0x18 Kernel panic - not syncing: hungtask: blocked tasks
For padatadoparallel, when the return err is 0 or -EBUSY, it will call waitforcompletion(&wait->completion) in testaeadveccfg. In normal case, aeadrequestcomplete() will be called in pcryptaeadserial and the return err is 0 for padatadoparallel. But, when pinst->flags is PADATARESET, the return err is -EBUSY for padatadoparallel, and it won't call aeadrequestcomplete(). Therefore, testaeadveccfg will hung at waitforcompletion(&wait->completion), which will cause hungtask.
The problem comes as following: (padatadoparallel) | rcureadlockbh(); | err = -EINVAL; | (padatareplace) | pinst->flags |= PADATARESET; err = -EBUSY | if (pinst->flags & PADATARESET) | rcureadunlockbh() | return err
In order to resolve the problem, we replace the return err -EBUSY with -EAGAIN, which means paralleldata is changing, and the caller should call it again.
v3: remove retry and just change the return err. v2: introduce padatatrydoparallel() in pcryptaeadencrypt and pcryptaeaddecrypt to solve the hungtask.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52813?
CVE-2023-52813 has been classified with a medium severity level due to the potential impact on system stability.
How do I fix CVE-2023-52813?
To resolve CVE-2023-52813, upgrade the Linux kernel to a version greater than or equal to the recommended patched versions listed in the advisory.
What systems are affected by CVE-2023-52813?
CVE-2023-52813 affects several Red Hat kernel versions and IBM Security Verify Governance products up to specific versions.
Is there a workaround for CVE-2023-52813?
There are no known workarounds for CVE-2023-52813, and applying the appropriate patches is the recommended course of action.
When was CVE-2023-52813 disclosed?
CVE-2023-52813 was disclosed as part of an advisory from the Linux kernel CVE team.