CVE-2023-53461

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

io_uring: wait interruptibly for request completions on exit

WHen the ring exits, cleanup is done and the final cancelation and

waiting on completions is done by io_ring_exit_work. That function is

invoked by kworker, which doesn't take any signals. Because of that, it

doesn't really matter if we wait for completions in TASK_INTERRUPTIBLE

or TASK_UNINTERRUPTIBLE state. However, it does matter to the hung task

detection checker!

Normally we expect cancelations and completions to happen rather

quickly. Some test cases, however, will exit the ring and park the

owning task stopped (eg via SIGSTOP). If the owning task needs to run

task_work to complete requests, then io_ring_exit_work won't make any

progress until the task is runnable again. Hence io_ring_exit_work can

trigger the hung task detection, which is particularly problematic if

panic-on-hung-task is enabled.

As the ring exit doesn't take signals to begin with,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References