CVE-2023-53832

Vulnerability

Overview

CVE-2023-53832 is a null-pointer dereference vulnerability in the Linux kernel's md/raid10 driver, specifically in the raid10_sync_request function. The root cause is an asymmetry in the synchronization lifecycle: init_resync() initializes a memory pool and sets conf->have_replacement, while close_sync() frees that pool. When recovery is skipped due to commit [1] (7e83ccbecd60), init_resync() is called but close_sync() is not, leaving the pool uninitialized for subsequent operations.

Exploitation

Conditions

To trigger the bug, an attacker must be able to perform a specific sequence of operations on a RAID10 array: create the array and let resync complete, then cause I/O errors to mark a device as WantReplacement, add a replacement device, and finally trigger recovery. Under these conditions, conf->have_replacement remains 0, so r10bio->dev[i].repl_bio is never allocated, leading to a null-pointer dereference when the sync code attempts to use it.

Impact

A successful exploit results in a denial of service (kernel panic) due to the null-pointer dereference. No privilege escalation or data corruption is described in the advisory, but the crash can render the system unavailable.

Mitigation

The fix, implemented in commits [2] and [3], ensures that init_resync() is not called when recovery is skipped, preventing the mismatch. Users should apply the latest stable kernel updates that include these patches.