CVE-2023-54324

Vulnerability

In the Linux kernel, a race condition exists in the multipath target of the device mapper (dm) subsystem. The retrieve_deps function walks the list of open devices without holding any lock, while multipath_message calls dm_get_device and dm_put_device which may add or remove devices from that list concurrently [description]. This lack of synchronization can lead to memory corruption or memory corruption [description].

Exploitation

An attacker with the ability to trigger retrieve_deps while simultaneous device addition/removal operations occur can exploit this race condition. The attack surface is local, requiring access to the device mapper ioctl interface or multipath tools. No special privileges beyond those needed to manipulate dm devices are required, making it exploitable by unprivileged users in some configurations [description].

Impact

Successful exploitation results in use-after-free memory access, potentially leading to memory corruption or arbitrary code execution with kernel privileges [description]. This could allow an attacker to crash the system or escalate privileges.

Mitigation

The fix introduces a new rw semaphore named devices_lock, which is taken for read in retrieve_deps and for write in dm_get_device and dm_put_device [description]. The patch has been accepted into the stable kernel tree; users should apply the relevant commits [1][2][3] to their kernels.