CVE-2023-52774
Description
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: protect device queue against concurrent access In dasd_profile_start() the amount of requests on the device queue are counted. The access to the device queue is unprotected against concurrent access. With a lot of parallel I/O, especially with alias devices enabled, the device queue can change while dasd_profile_start() is accessing the queue. In the worst case this leads to a kernel panic due to incorrect pointer accesses. Fix this by taking the device lock before accessing the queue and counting the requests. Additionally the check for a valid profile data pointer can be done earlier to avoid unnecessary locking in a hot path.
How to fix
- linux linux_kernel4.14.332, 4.19.301, 5.4.263, 5.10.203, 5.15.141, 6.1.65, 6.6.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 3.1 ≤ v < 4.14.332, 4.15 ≤ v < 4.19.301, 4.20 ≤ v < 5.4.263, 5.5 ≤ v < 5.10.203, 5.11 ≤ v < 5.15.141, 5.16 ≤ v < 6.1.65, 6.2 ≤ v < 6.6.4, 6.7 | 4.14.332, 4.19.301, 5.4.263, 5.10.203, 5.15.141, 6.1.65, 6.6.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.