Bugzilla – Bug 1220924
VUL-0: CVE-2023-52522: kernel: net: fix possible store tearing in neigh_periodic_work()
Last modified: 2024-06-25 18:16:08 UTC
In the Linux kernel, the following vulnerability has been resolved: net: fix possible store tearing in neigh_periodic_work() While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item from a list. Readers use rcu_deference(*np), we need to use either rcu_assign_pointer() or WRITE_ONCE() on writer side to prevent store tearing. I use rcu_assign_pointer() to have lockdep support, this was the choice made in neigh_flush_dev(). References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52522 https://www.cve.org/CVERecord?id=CVE-2023-52522 https://git.kernel.org/stable/c/147d89ee41434b97043c2dcb17a97dc151859baa https://git.kernel.org/stable/c/25563b581ba3a1f263a00e8c9a97f5e7363be6fd https://git.kernel.org/stable/c/2ea52a2fb8e87067e26bbab4efb8872639240eb0 https://git.kernel.org/stable/c/95eabb075a5902f4c0834ab1fb12dc35730c05af https://git.kernel.org/stable/c/a75152d233370362eebedb2643592e7c883cc9fc https://git.kernel.org/stable/c/f82aac8162871e87027692b36af335a2375d4580 https://bugzilla.redhat.com/show_bug.cgi?id=2267795
Offending commit (767e97e1e0db) found in: - SLE12-SP5 - SLE15-SP4 - SLE15-SP5 - SLE15-SP6 - cve/linux-3.0 - cve/linux-4.12 - cve/linux-4.4 - cve/linux-5.3 - stable stable and SLE15-SP6 already contain the fix, tracking other branches as affected.
Forgot fix, is: 95eabb075a59
@Denis, could you have a look? thanks ./scripts/check-kernel-fix CVE-2023-52522 25563b581ba3 ("net: fix possible store tearing in neigh_periodic_work()") merged v6.6-rc5~22^2~37 Fixes: 767e97e1e0db ("neigh: RCU conversion of struct neighbour") merged v2.6.37-rc1~147^2~204 Security fix for CVE-2023-52522 bsc#1220924 with CVSS 5.5 .............................. ACTION NEEDED! SLE15-SP5: MANUAL: backport 25563b581ba3a1f263a00e8c9a97f5e7363be6fd (Fixes 767e97e1e0db) SLE12-SP5: MANUAL: backport 25563b581ba3a1f263a00e8c9a97f5e7363be6fd (Fixes 767e97e1e0db) SLE12-SP3-TD: MANUAL: backport 25563b581ba3a1f263a00e8c9a97f5e7363be6fd (Fixes 767e97e1e0db)