CVE-2023-52587

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

IB/ipoib: Fix mcast list locking

Releasing the `priv->lock` while iterating the `priv->multicast_list` in

`ipoib_mcast_join_task()` opens a window for `ipoib_mcast_dev_flush()` to

remove the items while in the middle of iteration. If the mcast is removed

while the lock was dropped, the for loop spins forever resulting in a hard

lockup (as was reported on RHEL 4.18.0-372.75.1.el8_6 kernel):

Task A (kworker/u72:2 below) | Task B (kworker/u72:0 below)

-----------------------------------+-----------------------------------

ipoib_mcast_join_task(work) | ipoib_ib_dev_flush_light(work)

spin_lock_irq(&priv->lock) | __ipoib_ib_dev_flush(priv, ...)

list_for_each_entry(mcast, | ipoib_mcast_dev_flush(dev = priv->dev)

&priv->multicast_list, list) |

ipoib_mcast_join(dev, mcast) |

spin_unlock_irq(&priv->lock) |

|

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References