In the Linux kernel, the following vulnerability has been resolved:
net: fix possible store tearing in neighperiodicwork()
While looking at a related syzbot report involving neighperiodicwork(), I found that I forgot to add an annotation when deleting an RCU protected item from a list.
Readers use rcudeference(*np), we need to use either rcuassignpointer() or WRITEONCE() on writer side to prevent store tearing.
I use rcuassignpointer() to have lockdep support, this was the choice made in neighflushdev().
[
{
"id": "CVE-2023-52522-13a0b944",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95eabb075a5902f4c0834ab1fb12dc35730c05af",
"digest": {
"length": 1761.0,
"function_hash": "252065893535178019771669688610059256393"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "neigh_periodic_work",
"file": "net/core/neighbour.c"
}
},
{
"id": "CVE-2023-52522-26fc4124",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a75152d233370362eebedb2643592e7c883cc9fc",
"digest": {
"length": 1761.0,
"function_hash": "252065893535178019771669688610059256393"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "neigh_periodic_work",
"file": "net/core/neighbour.c"
}
},
{
"id": "CVE-2023-52522-2c510c0f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ea52a2fb8e87067e26bbab4efb8872639240eb0",
"digest": {
"length": 1761.0,
"function_hash": "252065893535178019771669688610059256393"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "neigh_periodic_work",
"file": "net/core/neighbour.c"
}
},
{
"id": "CVE-2023-52522-483dc7ff",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a75152d233370362eebedb2643592e7c883cc9fc",
"digest": {
"line_hashes": [
"123603784311841812992857975729282614217",
"240691631107732376721445850212060815589",
"257049473553259657974544596108164873450",
"16708528366064761810096109105491843477"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/core/neighbour.c"
}
},
{
"id": "CVE-2023-52522-4a2bf6ed",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25563b581ba3a1f263a00e8c9a97f5e7363be6fd",
"digest": {
"length": 1761.0,
"function_hash": "252065893535178019771669688610059256393"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "neigh_periodic_work",
"file": "net/core/neighbour.c"
}
},
{
"id": "CVE-2023-52522-60f8c28a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f82aac8162871e87027692b36af335a2375d4580",
"digest": {
"length": 1761.0,
"function_hash": "252065893535178019771669688610059256393"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "neigh_periodic_work",
"file": "net/core/neighbour.c"
}
},
{
"id": "CVE-2023-52522-a1c854d2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f82aac8162871e87027692b36af335a2375d4580",
"digest": {
"line_hashes": [
"123603784311841812992857975729282614217",
"240691631107732376721445850212060815589",
"257049473553259657974544596108164873450",
"16708528366064761810096109105491843477"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/core/neighbour.c"
}
},
{
"id": "CVE-2023-52522-b3bf8e1b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@147d89ee41434b97043c2dcb17a97dc151859baa",
"digest": {
"line_hashes": [
"123603784311841812992857975729282614217",
"240691631107732376721445850212060815589",
"257049473553259657974544596108164873450",
"16708528366064761810096109105491843477"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/core/neighbour.c"
}
},
{
"id": "CVE-2023-52522-bbc2637b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@147d89ee41434b97043c2dcb17a97dc151859baa",
"digest": {
"length": 1761.0,
"function_hash": "252065893535178019771669688610059256393"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "neigh_periodic_work",
"file": "net/core/neighbour.c"
}
},
{
"id": "CVE-2023-52522-c08d63a4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ea52a2fb8e87067e26bbab4efb8872639240eb0",
"digest": {
"line_hashes": [
"123603784311841812992857975729282614217",
"240691631107732376721445850212060815589",
"257049473553259657974544596108164873450",
"16708528366064761810096109105491843477"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/core/neighbour.c"
}
},
{
"id": "CVE-2023-52522-d56dafaa",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25563b581ba3a1f263a00e8c9a97f5e7363be6fd",
"digest": {
"line_hashes": [
"123603784311841812992857975729282614217",
"240691631107732376721445850212060815589",
"257049473553259657974544596108164873450",
"16708528366064761810096109105491843477"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/core/neighbour.c"
}
},
{
"id": "CVE-2023-52522-f4fc84d3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95eabb075a5902f4c0834ab1fb12dc35730c05af",
"digest": {
"line_hashes": [
"123603784311841812992857975729282614217",
"240691631107732376721445850212060815589",
"257049473553259657974544596108164873450",
"16708528366064761810096109105491843477"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "net/core/neighbour.c"
}
}
]