CVE-2023-52707

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sched/psi: Fix use-after-free in ep_remove_wait_queue()

If a non-root cgroup gets removed when there is a thread that registered

trigger and is polling on a pressure file within the cgroup, the polling

waitqueue gets freed in the following path:

do_rmdir

cgroup_rmdir

kernfs_drain_open_files

cgroup_file_release

cgroup_pressure_release

psi_trigger_destroy

However, the polling thread still has a reference to the pressure file and

will access the freed waitqueue when the file is closed or upon exit:

fput

ep_eventpoll_release

ep_free

ep_remove_wait_queue

remove_wait_queue

This results in use-after-free as pasted below.

The fundamental problem here is that cgroup_file_release() (and

consequently waitqueue's lifetime) is not tied to the file's real lifetime.

Using wake_up_pollfree() here might be less than ideal, but it is in line

with the comment at commit 4

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References