CVE-2023-53998

Vulnerability

CVE-2023-53998 is a race condition in the Linux kernel's virtio-rng (hardware random number generator) driver. The driver uses a shared data_avail counter to track how many entropy bytes are available in a buffer. When a read operation exhausts the available data, the buffer, the driver triggers a new request to the virtio device. However, there is no synchronization between the writer (the device's completion callback) and the reader (the read function), leading to a window where the reader can observe an updated data_avail value before the corresponding data has been written into the buffer [1].

Exploitation

An attacker would require local access to the kernel's /dev/hwrng device. The attacker must be able to open and read from the device file. The race window is narrow but can be triggered repeatedly by a malicious or buggy userspace program that reads from /dev/hwrng in a tight loop. No special privileges beyond read access to the device are required [2].

Impact

A successful exploit could cause a read operation to return stale or uninitialized data from the buffer, potentially leaking kernel memory contents to userspace. Since the random number generator is used by cryptographic subsystems and other security-sensitive components, this could weaken entropy guarantees or disclose sensitive information [3].

Mitigation

The fix was applied in Linux kernel stable releases via commits that commit [4]. Users should update to a kernel version containing the patch. The fix uses smp_store_release and smp_load_acquire to ensure proper ordering between the writer and reader, eliminating the race condition [1].