CVE-2023-53777

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

erofs: kill hooked chains to avoid loops on deduplicated compressed images

After heavily stressing EROFS with several images which include a

hand-crafted image of repeated patterns for more than 46 days, I found

two chains could be linked with each other almost simultaneously and

form a loop so that the entire loop won't be submitted. As a

consequence, the corresponding file pages will remain locked forever.

It can be _only_ observed on data-deduplicated compressed images.

For example, consider two chains with five pclusters in total:

Chain 1: 2->3->4->5 -- The tail pcluster is 5;

Chain 2: 5->1->2 -- The tail pcluster is 2.

Chain 2 could link to Chain 1 with pcluster 5; and Chain 1 could link

to Chain 2 at the same time with pcluster 2.

Since hooked chains are all linked locklessly now, I have no idea how

to simply avoid the race. Instead, let's avoid hooked chains completely

until I could wo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References