Strix
26.1K

CVE-2023-54268

UnknownEPSS 0.17%

Last modified

CVE-2023-54268 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: debugobjects: Don't wake up kswapd from fill_pool() syzbot is reporting a lockdep warning in fill_pool() because the allocation from debugobjects is using GFP_ATOMIC, which is (__GFP_HIGH | __GFP_KSWAPD_RECLAIM) and therefore tries to wake up kswapd, which acquires kswapd_wait::lock. Since fill_pool() might be called with arbitrary locks held, fill_pool() should not assume that acquiring kswapd_wait::lock is safe. Use __GFP_HIGH instead and remove __GFP_NORETRY as it is pointless for !__GFP_DIRECT_RECLAIM allocation.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Don't wake up kswapd from fill_pool() syzbot is reporting a lockdep warning in fill_pool() because the allocation from debugobjects is using GFP_ATOMIC, which is (__GFP_HIGH | __GFP_KSWAPD_RECLAIM) and therefore tries to wake up kswapd, which acquires kswapd_wait::lock. Since fill_pool() might be called with arbitrary locks held, fill_pool() should not assume that acquiring kswapd_wait::lock is safe. Use __GFP_HIGH instead and remove __GFP_NORETRY as it is pointless for !__GFP_DIRECT_RECLAIM allocation.

Metrics

EPSS Probability
0.17%

6.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 3ac7fe5a4aab409bd5674d0b070bce97f9d20872, < be646802b3dc408c4dc72a3ac32c3f4a0282414d; >= 3ac7fe5a4aab409bd5674d0b070bce97f9d20872, < fd673079749bac97bb30f1461df079e6c8e86511; >= 3ac7fe5a4aab409bd5674d0b070bce97f9d20872, < aee97eec77029270866c704f66cdf2881cbd2fe1; >= 3ac7fe5a4aab409bd5674d0b070bce97f9d20872, < d7fff52c99d52f180d8bef95d8ed8fec6343889c; >= 3ac7fe5a4aab409bd5674d0b070bce97f9d20872, < 4c088d30a72d9b8f9c6ae9362222942e4075cb00; >= 3ac7fe5a4aab409bd5674d0b070bce97f9d20872, < eb799279fb1f9c63c520fe8c1c41cb9154252db6
LinuxLinux2.6.26

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2023-54268?
In the Linux kernel, the following vulnerability has been resolved: debugobjects: Don't wake up kswapd from fill_pool() syzbot is reporting a lockdep warning in fill_pool() because the allocation from debugobjects is using GFP_ATOMIC, which is (__GFP_HIGH | __GFP_KSWAPD_RECLAIM) and therefore tries to wake up kswapd, which acquires kswapd_wait::lock. Since fill_pool() might be called with arbitrary locks held, fill_pool() should not assume that acquiring kswapd_wait::lock is safe. Use __GFP_HIGH instead and remove __GFP_NORETRY as it is pointless for !__GFP_DIRECT_RECLAIM allocation.
How severe is CVE-2023-54268?
Severity scoring for CVE-2023-54268 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2023-54268?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2023

View all 2023CVEs →

Are you affected by CVE-2023-54268?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST