CVE-2023-53709

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Handle race between rb_move_tail and rb_check_pages

It seems a data race between ring_buffer writing and integrity check.

That is, RB_FLAG of head_page is been updating, while at same time

RB_FLAG was cleared when doing integrity check rb_check_pages():

rb_check_pages() rb_handle_head_page():

-------- --------

rb_head_page_deactivate()

rb_head_page_set_normal()

rb_head_page_activate()

We do intergrity test of the list to check if the list is corrupted and

it is still worth doing it. So, let's refactor rb_check_pages() such that

we no longer clear and set flag during the list sanity checking.

[1] and [2] are the test to reproduce and the crash report respectively.

1:

``` read_trace.sh

while true;

do

# the "trace" file is closed after read

head -1 /sys/kernel/tracing/trace > /dev/null

done

```

``` repro.sh

sysctl -w ker

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References