CVE-2023-53731

Root

Cause

A potential deadlock was discovered in the Linux kernel's netlink subsystem, specifically in the netlink_set_err() function. The issue arises because nl_table_lock was taken without disabling interrupts, while another lock (&local->queue_stop_reason_lock) is taken in a SOFTIRQ context. This creates an inverse lock ordering scenario where an interrupt can cause a deadlock [1][2].

Exploitation

Conditions

The vulnerability can be triggered by any local user (unprivileged) who can cause a netlink error to be set via netlink_set_err() or trigger a netlink diagnostic dump via __netlink_diag_dump(). No special privileges are required beyond being able to interact with netlink sockets. A successful deadlock would result in a denial of service (system hang) for all CPUs [1].

Impact

An attacker achieving this deadlock would cause a complete denial of service, making the system unresponsive. There is no evidence of memory corruption or privilege escalation, only a system hang due to lock inversion [1].

Mitigation

The fix, backported to multiple stable kernel versions, adds local_bh_disable() / local_bh_enable() around the lock acquisitions in netlink_set_err() and __netlink_diag_dump(), ensuring that interrupts are disabled while holding nl_table_lock [1][2][3][4]. Users should apply the latest stable kernel updates to address CVE-2023-53731.