In the Linux kernel, the following vulnerability has been resolved:
ubi: ubiwlput_peb: Fix infinite loop when wear-leveling work failed
Following process will trigger an infinite loop in ubiwlput_peb():
ubifs_bgt ubi_bgt
ubifslebunmap ubilebunmap ubiebaunmapleb ubiwlputpeb wearlevelingworker e1 = rbentry(rbfirst(&ubi->used) e2 = getpebforwl(ubi) ubiioreadvidhdr // return err (flash fault) outerror: ubi->movefrom = ubi->moveto = NULL wlentrydestroy(ubi, e1) ubi->lookuptbl[e->pnum] = NULL retry: e = ubi->lookuptbl[pnum]; // return NULL if (e == ubi->move_from) { // NULL == NULL gets true goto retry; // infinite loop !!!
$ top PID USER PR NI VIRT RES SHR S %CPU %MEM COMMAND 7676 root 20 0 0 0 0 R 100.0 0.0 ubifsbgt00
Fix it by: 1) Letting ubiwlputpeb() returns directly if wearl leveling entry has been removed from 'ubi->lookuptbl'. 2) Using 'ubi->wllock' protecting wl entry deletion to preventing an use-after-free problem for wl entry in ubiwlput_peb().
Fetch a reproducer in [Link].
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53481.json",
"cna_assigner": "Linux"
}[
{
"id": "CVE-2023-53481-18f1dbf5",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3afaaf6f5867dc4ad383808d4053f428ec7b867d",
"target": {
"file": "drivers/mtd/ubi/wl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"183703722426247344489234815340602254132",
"196035369859132202317060735400658038694",
"183897834708219588138233492176885944116",
"21454997923499653464331534343985122454",
"261452113933689180673180741703709441477",
"22573501019015634856659503980715113316",
"24299708065890569594911064139730912268",
"259633932465458974270881257376792186792",
"299671918062343054378527513302654328383",
"70579562119648458836641301457846167117",
"107528512521554357810051093061849650679",
"131004709628718243379917677039791795480"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53481-3973e4e9",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3afaaf6f5867dc4ad383808d4053f428ec7b867d",
"target": {
"function": "ubi_wl_put_peb",
"file": "drivers/mtd/ubi/wl.c"
},
"digest": {
"length": 1837.0,
"function_hash": "140164018090453541323913666954056540702"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53481-3a932909",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b40d2fbf47af58377e898b5062077a47bb28a132",
"target": {
"function": "ubi_wl_put_peb",
"file": "drivers/mtd/ubi/wl.c"
},
"digest": {
"length": 1837.0,
"function_hash": "140164018090453541323913666954056540702"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53481-44677790",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b40d2fbf47af58377e898b5062077a47bb28a132",
"target": {
"function": "wear_leveling_worker",
"file": "drivers/mtd/ubi/wl.c"
},
"digest": {
"length": 6448.0,
"function_hash": "194841116775632482956565694827069335825"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53481-6e4217b8",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3afaaf6f5867dc4ad383808d4053f428ec7b867d",
"target": {
"function": "wear_leveling_worker",
"file": "drivers/mtd/ubi/wl.c"
},
"digest": {
"length": 6634.0,
"function_hash": "130758279469279172014978317259173694281"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53481-7c32a86d",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5af1c643184a5d09ff5b3f334077a4d0a163c677",
"target": {
"file": "drivers/mtd/ubi/wl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"183703722426247344489234815340602254132",
"196035369859132202317060735400658038694",
"183897834708219588138233492176885944116",
"21454997923499653464331534343985122454",
"261452113933689180673180741703709441477",
"22573501019015634856659503980715113316",
"24299708065890569594911064139730912268",
"259633932465458974270881257376792186792",
"299671918062343054378527513302654328383",
"70579562119648458836641301457846167117",
"107528512521554357810051093061849650679",
"131004709628718243379917677039791795480"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53481-7e2ede42",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b40d2fbf47af58377e898b5062077a47bb28a132",
"target": {
"file": "drivers/mtd/ubi/wl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"183703722426247344489234815340602254132",
"196035369859132202317060735400658038694",
"183897834708219588138233492176885944116",
"21454997923499653464331534343985122454",
"261452113933689180673180741703709441477",
"22573501019015634856659503980715113316",
"24299708065890569594911064139730912268",
"259633932465458974270881257376792186792",
"299671918062343054378527513302654328383",
"70579562119648458836641301457846167117",
"107528512521554357810051093061849650679",
"131004709628718243379917677039791795480"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53481-9977e381",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5af1c643184a5d09ff5b3f334077a4d0a163c677",
"target": {
"function": "wear_leveling_worker",
"file": "drivers/mtd/ubi/wl.c"
},
"digest": {
"length": 6716.0,
"function_hash": "183239098790372111699465325238967891610"
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53481-ca8b7d69",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5af1c643184a5d09ff5b3f334077a4d0a163c677",
"target": {
"function": "ubi_wl_put_peb",
"file": "drivers/mtd/ubi/wl.c"
},
"digest": {
"length": 1837.0,
"function_hash": "140164018090453541323913666954056540702"
},
"signature_type": "Function"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53481.json"