207 lines
12 KiB
JSON
207 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2023-53348",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-09-16T16:08:59.566Z",
|
|
"datePublished": "2025-09-17T14:56:39.800Z",
|
|
"dateUpdated": "2026-05-11T19:43:12.519Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-05-11T19:43:12.519Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix deadlock when aborting transaction during relocation with scrub\n\nBefore relocating a block group we pause scrub, then do the relocation and\nthen unpause scrub. The relocation process requires starting and committing\na transaction, and if we have a failure in the critical section of the\ntransaction commit path (transaction state >= TRANS_STATE_COMMIT_START),\nwe will deadlock if there is a paused scrub.\n\nThat results in stack traces like the following:\n\n [42.479] BTRFS info (device sdc): relocating block group 53876686848 flags metadata|raid6\n [42.936] BTRFS warning (device sdc): Skipping commit of aborted transaction.\n [42.936] ------------[ cut here ]------------\n [42.936] BTRFS: Transaction aborted (error -28)\n [42.936] WARNING: CPU: 11 PID: 346822 at fs/btrfs/transaction.c:1977 btrfs_commit_transaction+0xcc8/0xeb0 [btrfs]\n [42.936] Modules linked in: dm_flakey dm_mod loop btrfs (...)\n [42.936] CPU: 11 PID: 346822 Comm: btrfs Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1\n [42.936] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n [42.936] RIP: 0010:btrfs_commit_transaction+0xcc8/0xeb0 [btrfs]\n [42.936] Code: ff ff 45 8b (...)\n [42.936] RSP: 0018:ffffb58649633b48 EFLAGS: 00010282\n [42.936] RAX: 0000000000000000 RBX: ffff8be6ef4d5bd8 RCX: 0000000000000000\n [42.936] RDX: 0000000000000002 RSI: ffffffffb35e7782 RDI: 00000000ffffffff\n [42.936] RBP: ffff8be6ef4d5c98 R08: 0000000000000000 R09: ffffb586496339e8\n [42.936] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8be6d38c7c00\n [42.936] R13: 00000000ffffffe4 R14: ffff8be6c268c000 R15: ffff8be6ef4d5cf0\n [42.936] FS: 00007f381a82b340(0000) GS:ffff8beddfcc0000(0000) knlGS:0000000000000000\n [42.936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n [42.936] CR2: 00007f1e35fb7638 CR3: 0000000117680006 CR4: 0000000000370ee0\n [42.936] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n [42.936] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n [42.936] Call Trace:\n [42.936] <TASK>\n [42.936] ? start_transaction+0xcb/0x610 [btrfs]\n [42.936] prepare_to_relocate+0x111/0x1a0 [btrfs]\n [42.936] relocate_block_group+0x57/0x5d0 [btrfs]\n [42.936] ? btrfs_wait_nocow_writers+0x25/0xb0 [btrfs]\n [42.936] btrfs_relocate_block_group+0x248/0x3c0 [btrfs]\n [42.936] ? __pfx_autoremove_wake_function+0x10/0x10\n [42.936] btrfs_relocate_chunk+0x3b/0x150 [btrfs]\n [42.936] btrfs_balance+0x8ff/0x11d0 [btrfs]\n [42.936] ? __kmem_cache_alloc_node+0x14a/0x410\n [42.936] btrfs_ioctl+0x2334/0x32c0 [btrfs]\n [42.937] ? mod_objcg_state+0xd2/0x360\n [42.937] ? refill_obj_stock+0xb0/0x160\n [42.937] ? seq_release+0x25/0x30\n [42.937] ? __rseq_handle_notify_resume+0x3b5/0x4b0\n [42.937] ? percpu_counter_add_batch+0x2e/0xa0\n [42.937] ? __x64_sys_ioctl+0x88/0xc0\n [42.937] __x64_sys_ioctl+0x88/0xc0\n [42.937] do_syscall_64+0x38/0x90\n [42.937] entry_SYSCALL_64_after_hwframe+0x72/0xdc\n [42.937] RIP: 0033:0x7f381a6ffe9b\n [42.937] Code: 00 48 89 44 24 (...)\n [42.937] RSP: 002b:00007ffd45ecf060 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n [42.937] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f381a6ffe9b\n [42.937] RDX: 00007ffd45ecf150 RSI: 00000000c4009420 RDI: 0000000000000003\n [42.937] RBP: 0000000000000003 R08: 0000000000000013 R09: 0000000000000000\n [42.937] R10: 00007f381a60c878 R11: 0000000000000246 R12: 00007ffd45ed0423\n [42.937] R13: 00007ffd45ecf150 R14: 0000000000000000 R15: 00007ffd45ecf148\n [42.937] </TASK>\n [42.937] ---[ end trace 0000000000000000 ]---\n [42.937] BTRFS: error (device sdc: state A) in cleanup_transaction:1977: errno=-28 No space left\n [59.196] INFO: task btrfs:346772 blocked for more than 120 seconds.\n [59.196] Tainted: G W 6.3.0-rc2-btrfs-next-127+ #1\n [59.196] \"echo 0 > /proc/sys/kernel/hung_\n---truncated---"
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/btrfs/transaction.c",
|
|
"fs/btrfs/volumes.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "55e3a601c81cdca4497bf855fa4d331f8e830744",
|
|
"lessThan": "6134a4bb6b1c411a244edee041ac89266c78d45c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "55e3a601c81cdca4497bf855fa4d331f8e830744",
|
|
"lessThan": "10a5831b193390b77705fc174a309476c23ba64a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "55e3a601c81cdca4497bf855fa4d331f8e830744",
|
|
"lessThan": "2d82a40aa7d6fcae0250ec68b8566cdee7bfd44c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"fs/btrfs/transaction.c",
|
|
"fs/btrfs/volumes.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.3",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.3",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.23",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.2.10",
|
|
"lessThanOrEqual": "6.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "6.1.23"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "6.2.10"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "6.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6134a4bb6b1c411a244edee041ac89266c78d45c"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/10a5831b193390b77705fc174a309476c23ba64a"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/2d82a40aa7d6fcae0250ec68b8566cdee7bfd44c"
|
|
}
|
|
],
|
|
"title": "btrfs: fix deadlock when aborting transaction during relocation with scrub",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"scope": "UNCHANGED",
|
|
"version": "3.1",
|
|
"baseScore": 5.5,
|
|
"attackVector": "LOCAL",
|
|
"baseSeverity": "MEDIUM",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
|
"integrityImpact": "NONE",
|
|
"userInteraction": "NONE",
|
|
"attackComplexity": "LOW",
|
|
"availabilityImpact": "HIGH",
|
|
"privilegesRequired": "LOW",
|
|
"confidentialityImpact": "NONE"
|
|
}
|
|
},
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2023-53348",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-01-14T18:40:40.255895Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"type": "CWE",
|
|
"cweId": "CWE-667",
|
|
"description": "CWE-667 Improper Locking"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-01-14T18:43:03.123Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |