CVE-2023-52942

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask()

It was found that the check to see if a partition could use up all

the cpus from the parent cpuset in update_parent_subparts_cpumask()

was incorrect. As a result, it is possible to leave parent with no

effective cpu left even if there are tasks in the parent cpuset. This

can lead to system panic as reported in [1].

Fix this probem by updating the check to fail the enabling the partition

if parent's effective_cpus is a subset of the child's cpus_allowed.

Also record the error code when an error happens in update_prstate()

and add a test case where parent partition and child have the same cpu

list and parent has task. Enabling partition in the child will fail in

this case.

[1] https://www.spinics.net/lists/cgroups/msg36254.html

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References