CVE-2023-53060

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
02/05/2025
Last modified:
07/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> igb: revert rtnl_lock() that causes deadlock<br /> <br /> The commit 6faee3d4ee8b ("igb: Add lock to avoid data race") adds<br /> rtnl_lock to eliminate a false data race shown below<br /> <br /> (FREE from device detaching) | (USE from netdev core)<br /> igb_remove | igb_ndo_get_vf_config<br /> igb_disable_sriov | vf &gt;= adapter-&gt;vfs_allocated_count?<br /> kfree(adapter-&gt;vf_data) |<br /> adapter-&gt;vfs_allocated_count = 0 |<br /> | memcpy(... adapter-&gt;vf_data[vf]<br /> <br /> The above race will never happen and the extra rtnl_lock causes deadlock<br /> below<br /> <br /> [ 141.420169] <br /> [ 141.420672] __schedule+0x2dd/0x840<br /> [ 141.421427] schedule+0x50/0xc0<br /> [ 141.422041] schedule_preempt_disabled+0x11/0x20<br /> [ 141.422678] __mutex_lock.isra.13+0x431/0x6b0<br /> [ 141.423324] unregister_netdev+0xe/0x20<br /> [ 141.423578] igbvf_remove+0x45/0xe0 [igbvf]<br /> [ 141.423791] pci_device_remove+0x36/0xb0<br /> [ 141.423990] device_release_driver_internal+0xc1/0x160<br /> [ 141.424270] pci_stop_bus_device+0x6d/0x90<br /> [ 141.424507] pci_stop_and_remove_bus_device+0xe/0x20<br /> [ 141.424789] pci_iov_remove_virtfn+0xba/0x120<br /> [ 141.425452] sriov_disable+0x2f/0xf0<br /> [ 141.425679] igb_disable_sriov+0x4e/0x100 [igb]<br /> [ 141.426353] igb_remove+0xa0/0x130 [igb]<br /> [ 141.426599] pci_device_remove+0x36/0xb0<br /> [ 141.426796] device_release_driver_internal+0xc1/0x160<br /> [ 141.427060] driver_detach+0x44/0x90<br /> [ 141.427253] bus_remove_driver+0x55/0xe0<br /> [ 141.427477] pci_unregister_driver+0x2a/0xa0<br /> [ 141.428296] __x64_sys_delete_module+0x141/0x2b0<br /> [ 141.429126] ? mntput_no_expire+0x4a/0x240<br /> [ 141.429363] ? syscall_trace_enter.isra.19+0x126/0x1a0<br /> [ 141.429653] do_syscall_64+0x5b/0x80<br /> [ 141.429847] ? exit_to_user_mode_prepare+0x14d/0x1c0<br /> [ 141.430109] ? syscall_exit_to_user_mode+0x12/0x30<br /> [ 141.430849] ? do_syscall_64+0x67/0x80<br /> [ 141.431083] ? syscall_exit_to_user_mode_prepare+0x183/0x1b0<br /> [ 141.431770] ? syscall_exit_to_user_mode+0x12/0x30<br /> [ 141.432482] ? do_syscall_64+0x67/0x80<br /> [ 141.432714] ? exc_page_fault+0x64/0x140<br /> [ 141.432911] entry_SYSCALL_64_after_hwframe+0x72/0xdc<br /> <br /> Since the igb_disable_sriov() will call pci_disable_sriov() before<br /> releasing any resources, the netdev core will synchronize the cleanup to<br /> avoid any races. This patch removes the useless rtnl_(un)lock to guarantee<br /> correctness.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.14.291 (including) 4.14.312 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.19.256 (including) 4.19.280 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.4.211 (including) 5.4.240 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.10.138 (including) 5.10.177 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.15.63 (including) 5.15.105 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.19.4 (including) 6.0 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.0.1 (including) 6.1.22 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.2.9 (excluding)
cpe:2.3:o:linux:linux_kernel:6.0:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc7:*:*:*:*:*:*