CVE-2023-54019

Root

Cause

The vulnerability resides in the Linux kernel's PSI (Pressure Stall Information) subsystem. When a cgroup is removed, the kernel calls cgroup_file_release, which destroys the PSI trigger associated with the pressure file. However, if a userspace process is actively polling (via poll() or epoll()) on that file, the trigger's waitqueue head is freed while the polling process still holds a reference to it. This leads to a use-after-free condition when the polling process later accesses the waitqueue [1].

Exploitation

An attacker with local access to a system can trigger this by creating a cgroup, opening its memory.pressure or cpu.pressure file, and initiating a polling operation (e.g., using poll() or select()). Simultaneously, the attacker removes the cgroup. The kernel will free the PSI trigger's waitqueue while the polling process is still blocked on it, causing a use-after-free when the poll completes [2]. No special privileges are required beyond the ability to create and remove cgroups.

Impact

A successful exploit results in a use-after-free condition, which can lead to memory corruption, kernel crashes (denial of service), or potentially arbitrary code execution in the kernel context. The severity is high, as it allows a local unprivileged user to compromise system stability or escalate privileges.

Mitigation

The fix is included in Linux kernel stable releases. It replaces the PSI trigger's own waitqueue with the kernfs file's waitqueue, whose lifecycle is tied to the file's open count, thus avoiding the race condition. The previous partial fix (commit c2dbe32d5db5) has been reverted as obsolete [1]. Users should update to a patched kernel version.