CVE-2023-53722

Vulnerability

Description

In the Linux kernel's md (multiple device) driver, specifically the RAID1 personality, the function raid1_remove_disk() did not properly validate the rddev->raid_disk value against the current number of RAID disks (mddev->raid_disks). If rddev->raid_disk is greater than or equal to mddev->raid_disks, an out-of-bounds (OOB) access occurs, leading to potential memory corruption or system instability. This bug is analogous to previously fixed issues in md-raid10 (via commit d17f744e883b) and dm-raid (via commit 1ebc2cec0b7d) [1][2][3][4].

Exploitation

Conditions

The vulnerability can be triggered when a disk removal operation is performed in a RAID1 array, and the disk's internal raid_disk index has been left in an inconsistent state (e.g., after certain reconfiguration or partial initialization). An attacker with the ability to trigger disk removal, either through direct user interaction with the md device or via automated storage reconfiguration, could exploit this missing bounds check. No additional authentication beyond the existing capabilities to manage RAID devices is required if the attacker already has local access or can influence storage operations.

Impact

Successful exploitation could lead to an out-of-bounds read or write in kernel memory, potentially causing a denial of service (system crash or hang) or, under specific conditions, privilege escalation if the attacker can control the out-of-bounds access to corrupt critical kernel structures. The kernel bug is classified with a CVSS score that reflects the high severity of memory safety violations in the core storage subsystem.

Mitigation

The fix adds a bounds check to ensure that the disk index is valid before performing the removal. The patch has been integrated into the Linux kernel stable branches as commits [1][2][3][4]. Users are advised to update their kernels to versions containing these commits or apply the patch if building from source. No workarounds are available if the vulnerable kernel version is in use; only upgrading mitigates the risk.