CVE-2023-52562

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy()

After the commit in Fixes:, if a module that created a slab cache does not

release all of its allocated objects before destroying the cache (at rmmod

time), we might end up releasing the kmem_cache object without removing it

from the slab_caches list thus corrupting the list as kmem_cache_destroy()

ignores the return value from shutdown_cache(), which in turn never removes

the kmem_cache object from slabs_list in case __kmem_cache_shutdown() fails

to release all of the cache's slabs.

This is easily observable on a kernel built with CONFIG_DEBUG_LIST=y

as after that ill release the system will immediately trip on list_add,

or list_del, assertions similar to the one shown below as soon as another

kmem_cache gets created, or destroyed:

[ 1041.213632] list_del corruption. next->prev should be ffff89f596fb5768, but was 52f1e5016aeee75d. (next=f

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References