In the Linux kernel, the following vulnerability has been resolved:
pipe: wakeup wrwait after setting maxusage
Commit c73be61cede5 ("pipe: Add general notification queue support") a regression was introduced that would lock up resized pipes under certain conditions. See the reproducer in [1].
The commit resizing the pipe ring size was moved to a different function, doing that moved the wakeup for pipe->wrwait before actually raising pipe->maxusage. If a pipe was full before the resize occured it would result in the wakeup never actually triggering pipe_write.
Set @maxusage and @nraccounted before waking writers if this isn't a watch queue.
[Christian Brauner brauner@kernel.org: rewrite to account for watch queues]
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e95aada4cb93d42e25c30a0ef9eb2923d9711d4a",
"deprecated": false,
"id": "CVE-2023-52672-030584e9",
"signature_type": "Function",
"digest": {
"length": 832.0,
"function_hash": "133935251437513279003239827568118316817"
},
"target": {
"function": "pipe_set_size",
"file": "fs/pipe.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3efbd114b91525bb095b8ae046382197d92126b9",
"deprecated": false,
"id": "CVE-2023-52672-0f4b4924",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"217062505888524572579491177644823012083",
"255469989805010112906013563958714600072",
"288387231261374301005455641179088070508",
"237821751742225235143763825773657587518",
"242362475035631710331672047777964582975",
"114058008960951322409692025135431723066",
"269900224170960528558941057652309771787",
"104274289077379533324476217044424076282"
]
},
"target": {
"file": "fs/pipe.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6fb70694f8d1ac34e45246b0ac988f025e1e5b55",
"deprecated": false,
"id": "CVE-2023-52672-41cef85f",
"signature_type": "Function",
"digest": {
"length": 832.0,
"function_hash": "133935251437513279003239827568118316817"
},
"target": {
"function": "pipe_set_size",
"file": "fs/pipe.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68e51bdb1194f11d3452525b99c98aff6f837b24",
"deprecated": false,
"id": "CVE-2023-52672-5620b91e",
"signature_type": "Function",
"digest": {
"length": 1147.0,
"function_hash": "289121527880973361560121176102384726962"
},
"target": {
"function": "pipe_resize_ring",
"file": "fs/pipe.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68e51bdb1194f11d3452525b99c98aff6f837b24",
"deprecated": false,
"id": "CVE-2023-52672-62a7be74",
"signature_type": "Function",
"digest": {
"length": 832.0,
"function_hash": "133935251437513279003239827568118316817"
},
"target": {
"function": "pipe_set_size",
"file": "fs/pipe.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@162ae0e78bdabf84ef10c1293c4ed7865cb7d3c8",
"deprecated": false,
"id": "CVE-2023-52672-765c3c11",
"signature_type": "Function",
"digest": {
"length": 1147.0,
"function_hash": "289121527880973361560121176102384726962"
},
"target": {
"function": "pipe_resize_ring",
"file": "fs/pipe.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b87a1229d8668fbc78ebd9ca0fc797a76001c60f",
"deprecated": false,
"id": "CVE-2023-52672-9464133a",
"signature_type": "Function",
"digest": {
"length": 832.0,
"function_hash": "133935251437513279003239827568118316817"
},
"target": {
"function": "pipe_set_size",
"file": "fs/pipe.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3efbd114b91525bb095b8ae046382197d92126b9",
"deprecated": false,
"id": "CVE-2023-52672-967b9d22",
"signature_type": "Function",
"digest": {
"length": 1147.0,
"function_hash": "289121527880973361560121176102384726962"
},
"target": {
"function": "pipe_resize_ring",
"file": "fs/pipe.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68e51bdb1194f11d3452525b99c98aff6f837b24",
"deprecated": false,
"id": "CVE-2023-52672-9ace4fb8",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"217062505888524572579491177644823012083",
"255469989805010112906013563958714600072",
"288387231261374301005455641179088070508",
"237821751742225235143763825773657587518",
"242362475035631710331672047777964582975",
"114058008960951322409692025135431723066",
"269900224170960528558941057652309771787",
"104274289077379533324476217044424076282"
]
},
"target": {
"file": "fs/pipe.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3efbd114b91525bb095b8ae046382197d92126b9",
"deprecated": false,
"id": "CVE-2023-52672-9f54ecbd",
"signature_type": "Function",
"digest": {
"length": 832.0,
"function_hash": "133935251437513279003239827568118316817"
},
"target": {
"function": "pipe_set_size",
"file": "fs/pipe.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e95aada4cb93d42e25c30a0ef9eb2923d9711d4a",
"deprecated": false,
"id": "CVE-2023-52672-a57f8d99",
"signature_type": "Function",
"digest": {
"length": 1147.0,
"function_hash": "289121527880973361560121176102384726962"
},
"target": {
"function": "pipe_resize_ring",
"file": "fs/pipe.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b87a1229d8668fbc78ebd9ca0fc797a76001c60f",
"deprecated": false,
"id": "CVE-2023-52672-c26500a2",
"signature_type": "Function",
"digest": {
"length": 1147.0,
"function_hash": "289121527880973361560121176102384726962"
},
"target": {
"function": "pipe_resize_ring",
"file": "fs/pipe.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6fb70694f8d1ac34e45246b0ac988f025e1e5b55",
"deprecated": false,
"id": "CVE-2023-52672-d4ce0c7a",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"217062505888524572579491177644823012083",
"255469989805010112906013563958714600072",
"288387231261374301005455641179088070508",
"237821751742225235143763825773657587518",
"242362475035631710331672047777964582975",
"114058008960951322409692025135431723066",
"269900224170960528558941057652309771787",
"104274289077379533324476217044424076282"
]
},
"target": {
"file": "fs/pipe.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b87a1229d8668fbc78ebd9ca0fc797a76001c60f",
"deprecated": false,
"id": "CVE-2023-52672-d5ce6186",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"217062505888524572579491177644823012083",
"255469989805010112906013563958714600072",
"288387231261374301005455641179088070508",
"237821751742225235143763825773657587518",
"242362475035631710331672047777964582975",
"114058008960951322409692025135431723066",
"269900224170960528558941057652309771787",
"104274289077379533324476217044424076282"
]
},
"target": {
"file": "fs/pipe.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6fb70694f8d1ac34e45246b0ac988f025e1e5b55",
"deprecated": false,
"id": "CVE-2023-52672-d75db676",
"signature_type": "Function",
"digest": {
"length": 1147.0,
"function_hash": "289121527880973361560121176102384726962"
},
"target": {
"function": "pipe_resize_ring",
"file": "fs/pipe.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@162ae0e78bdabf84ef10c1293c4ed7865cb7d3c8",
"deprecated": false,
"id": "CVE-2023-52672-de830780",
"signature_type": "Function",
"digest": {
"length": 832.0,
"function_hash": "133935251437513279003239827568118316817"
},
"target": {
"function": "pipe_set_size",
"file": "fs/pipe.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e95aada4cb93d42e25c30a0ef9eb2923d9711d4a",
"deprecated": false,
"id": "CVE-2023-52672-f2708444",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"217062505888524572579491177644823012083",
"255469989805010112906013563958714600072",
"288387231261374301005455641179088070508",
"237821751742225235143763825773657587518",
"242362475035631710331672047777964582975",
"114058008960951322409692025135431723066",
"269900224170960528558941057652309771787",
"104274289077379533324476217044424076282"
]
},
"target": {
"file": "fs/pipe.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@162ae0e78bdabf84ef10c1293c4ed7865cb7d3c8",
"deprecated": false,
"id": "CVE-2023-52672-fca12b9f",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"217062505888524572579491177644823012083",
"255469989805010112906013563958714600072",
"288387231261374301005455641179088070508",
"237821751742225235143763825773657587518",
"242362475035631710331672047777964582975",
"114058008960951322409692025135431723066",
"269900224170960528558941057652309771787",
"104274289077379533324476217044424076282"
]
},
"target": {
"file": "fs/pipe.c"
}
}
]