247 lines
15 KiB
JSON
247 lines
15 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2023-53233",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-09-15T14:19:21.847Z",
|
|
"datePublished": "2025-09-15T14:22:05.378Z",
|
|
"dateUpdated": "2026-05-11T19:40:49.189Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-05-11T19:40:49.189Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix deadlock triggered by cancel_delayed_work_syn()\n\nThe following LOCKDEP was detected:\n\t\tWorkqueue: events smc_lgr_free_work [smc]\n\t\tWARNING: possible circular locking dependency detected\n\t\t6.1.0-20221027.rc2.git8.56bc5b569087.300.fc36.s390x+debug #1 Not tainted\n\t\t------------------------------------------------------\n\t\tkworker/3:0/176251 is trying to acquire lock:\n\t\t00000000f1467148 ((wq_completion)smc_tx_wq-00000000#2){+.+.}-{0:0},\n\t\t\tat: __flush_workqueue+0x7a/0x4f0\n\t\tbut task is already holding lock:\n\t\t0000037fffe97dc8 ((work_completion)(&(&lgr->free_work)->work)){+.+.}-{0:0},\n\t\t\tat: process_one_work+0x232/0x730\n\t\twhich lock already depends on the new lock.\n\t\tthe existing dependency chain (in reverse order) is:\n\t\t-> #4 ((work_completion)(&(&lgr->free_work)->work)){+.+.}-{0:0}:\n\t\t __lock_acquire+0x58e/0xbd8\n\t\t lock_acquire.part.0+0xe2/0x248\n\t\t lock_acquire+0xac/0x1c8\n\t\t __flush_work+0x76/0xf0\n\t\t __cancel_work_timer+0x170/0x220\n\t\t __smc_lgr_terminate.part.0+0x34/0x1c0 [smc]\n\t\t smc_connect_rdma+0x15e/0x418 [smc]\n\t\t __smc_connect+0x234/0x480 [smc]\n\t\t smc_connect+0x1d6/0x230 [smc]\n\t\t __sys_connect+0x90/0xc0\n\t\t __do_sys_socketcall+0x186/0x370\n\t\t __do_syscall+0x1da/0x208\n\t\t system_call+0x82/0xb0\n\t\t-> #3 (smc_client_lgr_pending){+.+.}-{3:3}:\n\t\t __lock_acquire+0x58e/0xbd8\n\t\t lock_acquire.part.0+0xe2/0x248\n\t\t lock_acquire+0xac/0x1c8\n\t\t __mutex_lock+0x96/0x8e8\n\t\t mutex_lock_nested+0x32/0x40\n\t\t smc_connect_rdma+0xa4/0x418 [smc]\n\t\t __smc_connect+0x234/0x480 [smc]\n\t\t smc_connect+0x1d6/0x230 [smc]\n\t\t __sys_connect+0x90/0xc0\n\t\t __do_sys_socketcall+0x186/0x370\n\t\t __do_syscall+0x1da/0x208\n\t\t system_call+0x82/0xb0\n\t\t-> #2 (sk_lock-AF_SMC){+.+.}-{0:0}:\n\t\t __lock_acquire+0x58e/0xbd8\n\t\t lock_acquire.part.0+0xe2/0x248\n\t\t lock_acquire+0xac/0x1c8\n\t\t lock_sock_nested+0x46/0xa8\n\t\t smc_tx_work+0x34/0x50 [smc]\n\t\t process_one_work+0x30c/0x730\n\t\t worker_thread+0x62/0x420\n\t\t kthread+0x138/0x150\n\t\t __ret_from_fork+0x3c/0x58\n\t\t ret_from_fork+0xa/0x40\n\t\t-> #1 ((work_completion)(&(&smc->conn.tx_work)->work)){+.+.}-{0:0}:\n\t\t __lock_acquire+0x58e/0xbd8\n\t\t lock_acquire.part.0+0xe2/0x248\n\t\t lock_acquire+0xac/0x1c8\n\t\t process_one_work+0x2bc/0x730\n\t\t worker_thread+0x62/0x420\n\t\t kthread+0x138/0x150\n\t\t __ret_from_fork+0x3c/0x58\n\t\t ret_from_fork+0xa/0x40\n\t\t-> #0 ((wq_completion)smc_tx_wq-00000000#2){+.+.}-{0:0}:\n\t\t check_prev_add+0xd8/0xe88\n\t\t validate_chain+0x70c/0xb20\n\t\t __lock_acquire+0x58e/0xbd8\n\t\t lock_acquire.part.0+0xe2/0x248\n\t\t lock_acquire+0xac/0x1c8\n\t\t __flush_workqueue+0xaa/0x4f0\n\t\t drain_workqueue+0xaa/0x158\n\t\t destroy_workqueue+0x44/0x2d8\n\t\t smc_lgr_free+0x9e/0xf8 [smc]\n\t\t process_one_work+0x30c/0x730\n\t\t worker_thread+0x62/0x420\n\t\t kthread+0x138/0x150\n\t\t __ret_from_fork+0x3c/0x58\n\t\t ret_from_fork+0xa/0x40\n\t\tother info that might help us debug this:\n\t\tChain exists of:\n\t\t (wq_completion)smc_tx_wq-00000000#2\n\t \t --> smc_client_lgr_pending\n\t\t --> (work_completion)(&(&lgr->free_work)->work)\n\t\t Possible unsafe locking scenario:\n\t\t CPU0 CPU1\n\t\t ---- ----\n\t\t lock((work_completion)(&(&lgr->free_work)->work));\n\t\t lock(smc_client_lgr_pending);\n\t\t lock((work_completion)\n\t\t\t\t\t(&(&lgr->free_work)->work));\n\t\t lock((wq_completion)smc_tx_wq-00000000#2);\n\t\t *** DEADLOCK ***\n\t\t2 locks held by kworker/3:0/176251:\n\t\t #0: 0000000080183548\n\t\t\t((wq_completion)events){+.+.}-{0:0},\n\t\t\t\tat: process_one_work+0x232/0x730\n\t\t #1: 0000037fffe97dc8\n\t\t\t((work_completion)\n\t\t\t (&(&lgr->free_work)->work)){+.+.}-{0:0},\n\t\t\t\tat: process_one_work+0x232/0x730\n\t\tstack backtr\n---truncated---"
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/smc/smc_core.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "a52bcc919b14c9d78f03b2b4ff604e5ca69c7e6d",
|
|
"lessThan": "9708efad9ba5095b9bb7916e11a135b3bd66c071",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a52bcc919b14c9d78f03b2b4ff604e5ca69c7e6d",
|
|
"lessThan": "b615238e5bc01e13dc0610febddc1ca99bab1df6",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a52bcc919b14c9d78f03b2b4ff604e5ca69c7e6d",
|
|
"lessThan": "3517584cf1b35bd02f4a90267ddf9dcf17bd9c87",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a52bcc919b14c9d78f03b2b4ff604e5ca69c7e6d",
|
|
"lessThan": "c9ca2257150272df1b8d9ebe5059197ffea6e913",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "a52bcc919b14c9d78f03b2b4ff604e5ca69c7e6d",
|
|
"lessThan": "13085e1b5cab8ad802904d72e6a6dae85ae0cd20",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/smc/smc_core.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.8",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.8",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.176",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.104",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.21",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.2.8",
|
|
"lessThanOrEqual": "6.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.8",
|
|
"versionEndExcluding": "5.10.176"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.8",
|
|
"versionEndExcluding": "5.15.104"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.8",
|
|
"versionEndExcluding": "6.1.21"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.8",
|
|
"versionEndExcluding": "6.2.8"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.8",
|
|
"versionEndExcluding": "6.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/9708efad9ba5095b9bb7916e11a135b3bd66c071"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b615238e5bc01e13dc0610febddc1ca99bab1df6"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3517584cf1b35bd02f4a90267ddf9dcf17bd9c87"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c9ca2257150272df1b8d9ebe5059197ffea6e913"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/13085e1b5cab8ad802904d72e6a6dae85ae0cd20"
|
|
}
|
|
],
|
|
"title": "net/smc: fix deadlock triggered by cancel_delayed_work_syn()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"scope": "UNCHANGED",
|
|
"version": "3.1",
|
|
"baseScore": 5.5,
|
|
"attackVector": "LOCAL",
|
|
"baseSeverity": "MEDIUM",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
|
"integrityImpact": "NONE",
|
|
"userInteraction": "NONE",
|
|
"attackComplexity": "LOW",
|
|
"availabilityImpact": "HIGH",
|
|
"privilegesRequired": "LOW",
|
|
"confidentialityImpact": "NONE"
|
|
}
|
|
},
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2023-53233",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-01-14T17:55:41.706072Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"type": "CWE",
|
|
"cweId": "CWE-667",
|
|
"description": "CWE-667 Improper Locking"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-01-14T18:02:49.503Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |