In the Linux kernel, the following vulnerability has been resolved:
s390/dasd: protect device queue against concurrent access
In dasdprofilestart() the amount of requests on the device queue are counted. The access to the device queue is unprotected against concurrent access. With a lot of parallel I/O, especially with alias devices enabled, the device queue can change while dasdprofilestart() is accessing the queue. In the worst case this leads to a kernel panic due to incorrect pointer accesses.
Fix this by taking the device lock before accessing the queue and counting the requests. Additionally the check for a valid profile data pointer can be done earlier to avoid unnecessary locking in a hot path.
[
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/s390/block/dasd.c",
"function": "dasd_profile_start"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ebdc569a07a3e8dbe66b4184922ad6f88ac0b96f",
"digest": {
"length": 1201.0,
"function_hash": "174668188676222005490253236445878541417"
},
"id": "CVE-2023-52774-1018668a"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/s390/block/dasd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f75617cc8df4155374132f0b500b0b3ebb967458",
"digest": {
"line_hashes": [
"17529789283574996067871818116171528836",
"254046811015810482754476395351429446438",
"272969710976374114269669546879576983411",
"240726071906022318401454235874682845276",
"198739176187248823313198661755960963875",
"282466247967201292713429690069542921707",
"68983475098074493601658042169552901675",
"233128287923848663249515032517423485586",
"294299729709424001341291178333754998863",
"19179623668427643403980151660067560979",
"209657696175817303088597620044802990553",
"247187042422338895298927519223455904996",
"189907659232465759793554682251587788313",
"8572459902981728597614491676413324693",
"15503887688158762064552343007832326964"
],
"threshold": 0.9
},
"id": "CVE-2023-52774-418cdd77"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/s390/block/dasd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ebdc569a07a3e8dbe66b4184922ad6f88ac0b96f",
"digest": {
"line_hashes": [
"17529789283574996067871818116171528836",
"254046811015810482754476395351429446438",
"272969710976374114269669546879576983411",
"240726071906022318401454235874682845276",
"198739176187248823313198661755960963875",
"282466247967201292713429690069542921707",
"68983475098074493601658042169552901675",
"233128287923848663249515032517423485586",
"294299729709424001341291178333754998863",
"19179623668427643403980151660067560979",
"209657696175817303088597620044802990553",
"247187042422338895298927519223455904996",
"189907659232465759793554682251587788313",
"8572459902981728597614491676413324693",
"15503887688158762064552343007832326964"
],
"threshold": 0.9
},
"id": "CVE-2023-52774-ba8724e2"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/s390/block/dasd.c",
"function": "dasd_profile_start"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f75617cc8df4155374132f0b500b0b3ebb967458",
"digest": {
"length": 1201.0,
"function_hash": "174668188676222005490253236445878541417"
},
"id": "CVE-2023-52774-c9c636a3"
}
]