CVE-2023-53231

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

erofs: Fix detection of atomic context

Current check for atomic context is not sufficient as

z_erofs_decompressqueue_endio can be called under rcu lock

from blk_mq_flush_plug_list(). See the stacktrace [1]

In such case we should hand off the decompression work for async

processing rather than trying to do sync decompression in current

context. Patch fixes the detection by checking for

rcu_read_lock_any_held() and while at it use more appropriate

!in_task() check than in_atomic().

Background: Historically erofs would always schedule a kworker for

decompression which would incur the scheduling cost regardless of

the context. But z_erofs_decompressqueue_endio() may not always

be in atomic context and we could actually benefit from doing the

decompression in z_erofs_decompressqueue_endio() if we are in

thread context, for example when running with dm-verity.

This optimization was later added in patch [2] which has show

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References