DEBIAN-CVE-2023-53060

Source
https://security-tracker.debian.org/tracker/CVE-2023-53060
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53060.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2023-53060
Upstream
Published
2025-05-02T16:15:25.060Z
Modified
2025-11-20T10:16:53.578833Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved: igb: revert rtnllock() that causes deadlock The commit 6faee3d4ee8b ("igb: Add lock to avoid data race") adds rtnllock to eliminate a false data race shown below (FREE from device detaching) | (USE from netdev core) igbremove | igbndogetvfconfig igbdisablesriov | vf >= adapter->vfsallocatedcount? kfree(adapter->vfdata) | adapter->vfsallocatedcount = 0 | | memcpy(... adapter->vfdata[vf] The above race will never happen and the extra rtnllock causes deadlock below [ 141.420169] <TASK> [ 141.420672] __schedule+0x2dd/0x840 [ 141.421427] schedule+0x50/0xc0 [ 141.422041] schedulepreemptdisabled+0x11/0x20 [ 141.422678] __mutexlock.isra.13+0x431/0x6b0 [ 141.423324] unregisternetdev+0xe/0x20 [ 141.423578] igbvfremove+0x45/0xe0 [igbvf] [ 141.423791] pcideviceremove+0x36/0xb0 [ 141.423990] devicereleasedriverinternal+0xc1/0x160 [ 141.424270] pcistopbusdevice+0x6d/0x90 [ 141.424507] pcistopandremovebusdevice+0xe/0x20 [ 141.424789] pciiovremovevirtfn+0xba/0x120 [ 141.425452] sriovdisable+0x2f/0xf0 [ 141.425679] igbdisablesriov+0x4e/0x100 [igb] [ 141.426353] igbremove+0xa0/0x130 [igb] [ 141.426599] pcideviceremove+0x36/0xb0 [ 141.426796] devicereleasedriverinternal+0xc1/0x160 [ 141.427060] driverdetach+0x44/0x90 [ 141.427253] busremovedriver+0x55/0xe0 [ 141.427477] pciunregister_driver+0x2a/0xa0 [ 141.428296] _x64sysdeletemodule+0x141/0x2b0 [ 141.429126] ? mntputnoexpire+0x4a/0x240 [ 141.429363] ? syscalltraceenter.isra.19+0x126/0x1a0 [ 141.429653] dosyscall64+0x5b/0x80 [ 141.429847] ? exittousermodeprepare+0x14d/0x1c0 [ 141.430109] ? syscallexittousermode+0x12/0x30 [ 141.430849] ? dosyscall64+0x67/0x80 [ 141.431083] ? syscallexittousermodeprepare+0x183/0x1b0 [ 141.431770] ? syscallexittousermode+0x12/0x30 [ 141.432482] ? dosyscall64+0x67/0x80 [ 141.432714] ? excpagefault+0x64/0x140 [ 141.432911] entrySYSCALL64afterhwframe+0x72/0xdc Since the igbdisablesriov() will call pcidisablesriov() before releasing any resources, the netdev core will synchronize the cleanup to avoid any races. This patch removes the useless rtnl(un)lock to guarantee correctness.

References

Affected packages

Debian:11 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.10.178-1

Affected versions

5.*
5.10.46-4
5.10.46-5
5.10.70-1~bpo10+1
5.10.70-1
5.10.84-1
5.10.92-1~bpo10+1
5.10.92-1
5.10.92-2
5.10.103-1~bpo10+1
5.10.103-1
5.10.106-1
5.10.113-1
5.10.120-1~bpo10+1
5.10.120-1
5.10.127-1
5.10.127-2~bpo10+1
5.10.127-2
5.10.136-1
5.10.140-1
5.10.148-1
5.10.149-1
5.10.149-2
5.10.158-1
5.10.158-2
5.10.162-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53060.json"

Debian:12 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.25-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53060.json"

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.25-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53060.json"

Debian:14 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.1.25-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-53060.json"