CVE-2023-54117

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

s390/dcssblk: fix kernel crash with list_add corruption

Commit fb08a1908cb1 ("dax: simplify the dax_device <-> gendisk

association") introduced new logic for gendisk association, requiring

drivers to explicitly call dax_add_host() and dax_remove_host().

For dcssblk driver, some dax_remove_host() calls were missing, e.g. in

device remove path. The commit also broke error handling for out_dax case

in device add path, resulting in an extra put_device() w/o the previous

get_device() in that case.

This lead to stale xarray entries after device add / remove cycles. In the

case when a previously used struct gendisk pointer (xarray index) would be

used again, because blk_alloc_disk() happened to return such a pointer, the

xa_insert() in dax_add_host() would fail and go to out_dax, doing the extra

put_device() in the error path. In combination with an already flawed error

handling in dcssblk (device_register() cleanup), whi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References