In the Linux kernel, the following vulnerability has been resolved: srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL Commit 994f706872e6 ("srcu: Make Tree SRCU able to operate without snp_node array") assumes that cpu 0 is always online. However, there really are situations when some other CPU is the boot CPU, for example, when booting a kdump kernel with the maxcpus=1 boot parameter. On PowerPC, the kdump kernel can hang as follows: ... [ 1.740036] systemd[1]: Hostname set to <xyz.com> [ 243.686240] INFO: task systemd:1 blocked for more than 122 seconds. [ 243.686264] Not tainted 6.1.0-rc1 #1 [ 243.686272] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 243.686281] task:systemd state:D stack:0 pid:1 ppid:0 flags:0x00042000 [ 243.686296] Call Trace: [ 243.686301] [c000000016657640] [c000000016657670] 0xc000000016657670 (unreliable) [ 243.686317] [c000000016657830] [c00000001001dec0] __switch_to+0x130/0x220 [ 243.686333] [c000000016657890] [c000000010f607b8] __schedule+0x1f8/0x580 [ 243.686347] [c000000016657940] [c000000010f60bb4] schedule+0x74/0x140 [ 243.686361] [c0000000166579b0] [c000000010f699b8] schedule_timeout+0x168/0x1c0 [ 243.686374] [c000000016657a80] [c000000010f61de8] __wait_for_common+0x148/0x360 [ 243.686387] [c000000016657b20] [c000000010176bb0] __flush_work.isra.0+0x1c0/0x3d0 [ 243.686401] [c000000016657bb0] [c0000000105f2768] fsnotify_wait_marks_destroyed+0x28/0x40 [ 243.686415] [c000000016657bd0] [c0000000105f21b8] fsnotify_destroy_group+0x68/0x160 [ 243.686428] [c000000016657c40] [c0000000105f6500] inotify_release+0x30/0xa0 [ 243.686440] [c000000016657cb0] [c0000000105751a8] __fput+0xc8/0x350 [ 243.686452] [c000000016657d00] [c00000001017d524] task_work_run+0xe4/0x170 [ 243.686464] [c000000016657d50] [c000000010020e94] do_notify_resume+0x134/0x140 [ 243.686478] [c000000016657d80] [c00000001002eb18] interrupt_exit_user_prepare_main+0x198/0x270 [ 243.686493] [c000000016657de0] [c00000001002ec60] syscall_exit_prepare+0x70/0x180 [ 243.686505] [c000000016657e10] [c00000001000bf7c] system_call_vectored_common+0xfc/0x280 [ 243.686520] --- interrupt: 3000 at 0x7fffa47d5ba4 [ 243.686528] NIP: 00007fffa47d5ba4 LR: 0000000000000000 CTR: 0000000000000000 [ 243.686538] REGS: c000000016657e80 TRAP: 3000 Not tainted (6.1.0-rc1) [ 243.686548] MSR: 800000000000d033 <SF,EE,PR,ME,IR,DR,RI,LE> CR: 42044440 XER: 00000000 [ 243.686572] IRQMASK: 0 [ 243.686572] GPR00: 0000000000000006 00007ffffa606710 00007fffa48e7200 0000000000000000 [ 243.686572] GPR04: 0000000000000002 000000000000000a 0000000000000000 0000000000000001 [ 243.686572] GPR08: 000001000c172dd0 0000000000000000 0000000000000000 0000000000000000 [ 243.686572] GPR12: 0000000000000000 00007fffa4ff4bc0 0000000000000000 0000000000000000 [ 243.686572] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 243.686572] GPR20: 0000000132dfdc50 000000000000000e 0000000000189375 0000000000000000 [ 243.686572] GPR24: 00007ffffa606ae0 0000000000000005 000001000c185490 000001000c172570 [ 243.686572] GPR28: 000001000c172990 000001000c184850 000001000c172e00 00007fffa4fedd98 [ 243.686683] NIP [00007fffa47d5ba4] 0x7fffa47d5ba4 [ 243.686691] LR [0000000000000000] 0x0 [ 243.686698] --- interrupt: 3000 [ 243.686708] INFO: task kworker/u16:1:24 blocked for more than 122 seconds. [ 243.686717] Not tainted 6.1.0-rc1 #1 [ 243.686724] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 243.686733] task:kworker/u16:1 state:D stack:0 pid:24 ppid:2 flags:0x00000800 [ 243.686747] Workqueue: events_unbound fsnotify_mark_destroy_workfn [ 243.686758] Call Trace: [ 243.686762] [c0000000166736e0] [c00000004fd91000] 0xc00000004fd91000 (unreliable) [ 243.686775] [c0000000166738d0] [c00000001001dec0] __switch_to+0x130/0x220 [ 243.686788] [c000000016673930] [c000000010f607b8] __schedule+0x1f8/0x ---truncated---

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL Commit 994f706872e6 (srcu: Make Tree SRCU     able to operate without snp_node array) assumes that cpu 0 is always online. However, there really are     situations when some other CPU is the boot CPU, for example, when booting a kdump kernel with the     maxcpus=1 boot parameter. On PowerPC, the kdump kernel can hang as follows: ... [ 1.740036] systemd[1]:
    Hostname set to <xyz.com> [ 243.686240] INFO: task systemd:1 blocked for more than 122 seconds. [     243.686264] Not tainted 6.1.0-rc1 #1 [ 243.686272] echo 0 > /proc/sys/kernel/hung_task_timeout_secs     disables this message. [ 243.686281] task:systemd state:D stack:0 pid:1 ppid:0 flags:0x00042000 [     243.686296] Call Trace: [ 243.686301] [c000000016657640] [c000000016657670] 0xc000000016657670     (unreliable) [ 243.686317] [c000000016657830] [c00000001001dec0] __switch_to+0x130/0x220 [ 243.686333]     [c000000016657890] [c000000010f607b8] __schedule+0x1f8/0x580 [ 243.686347] [c000000016657940]     [c000000010f60bb4] schedule+0x74/0x140 [ 243.686361] [c0000000166579b0] [c000000010f699b8]     schedule_timeout+0x168/0x1c0 [ 243.686374] [c000000016657a80] [c000000010f61de8]
    __wait_for_common+0x148/0x360 [ 243.686387] [c000000016657b20] [c000000010176bb0]
    __flush_work.isra.0+0x1c0/0x3d0 [ 243.686401] [c000000016657bb0] [c0000000105f2768]     fsnotify_wait_marks_destroyed+0x28/0x40 [ 243.686415] [c000000016657bd0] [c0000000105f21b8]     fsnotify_destroy_group+0x68/0x160 [ 243.686428] [c000000016657c40] [c0000000105f6500]     inotify_release+0x30/0xa0 [ 243.686440] [c000000016657cb0] [c0000000105751a8] __fput+0xc8/0x350 [     243.686452] [c000000016657d00] [c00000001017d524] task_work_run+0xe4/0x170 [ 243.686464]     [c000000016657d50] [c000000010020e94] do_notify_resume+0x134/0x140 [ 243.686478] [c000000016657d80]     [c00000001002eb18] interrupt_exit_user_prepare_main+0x198/0x270 [ 243.686493] [c000000016657de0]     [c00000001002ec60] syscall_exit_prepare+0x70/0x180 [ 243.686505] [c000000016657e10] [c00000001000bf7c]     system_call_vectored_common+0xfc/0x280 [ 243.686520] --- interrupt: 3000 at 0x7fffa47d5ba4 [ 243.686528]     NIP: 00007fffa47d5ba4 LR: 0000000000000000 CTR: 0000000000000000 [ 243.686538] REGS: c000000016657e80     TRAP: 3000 Not tainted (6.1.0-rc1) [ 243.686548] MSR: 800000000000d033 <SF,EE,PR,ME,IR,DR,RI,LE> CR:
    42044440 XER: 00000000 [ 243.686572] IRQMASK: 0 [ 243.686572] GPR00: 0000000000000006 00007ffffa606710     00007fffa48e7200 0000000000000000 [ 243.686572] GPR04: 0000000000000002 000000000000000a 0000000000000000     0000000000000001 [ 243.686572] GPR08: 000001000c172dd0 0000000000000000 0000000000000000 0000000000000000     [ 243.686572] GPR12: 0000000000000000 00007fffa4ff4bc0 0000000000000000 0000000000000000 [ 243.686572]     GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 243.686572] GPR20:
    0000000132dfdc50 000000000000000e 0000000000189375 0000000000000000 [ 243.686572] GPR24: 00007ffffa606ae0     0000000000000005 000001000c185490 000001000c172570 [ 243.686572] GPR28: 000001000c172990 000001000c184850     000001000c172e00 00007fffa4fedd98 [ 243.686683] NIP [00007fffa47d5ba4] 0x7fffa47d5ba4 [ 243.686691] LR     [0000000000000000] 0x0 [ 243.686698] --- interrupt: 3000 [ 243.686708] INFO: task kworker/u16:1:24 blocked     for more than 122 seconds. [ 243.686717] Not tainted 6.1.0-rc1 #1 [ 243.686724] echo 0 >     /proc/sys/kernel/hung_task_timeout_secs disables this message. [ 243.686733] task:kworker/u16:1 state:D     stack:0 pid:24 ppid:2 flags:0x00000800 [ 243.686747] Workqueue: events_unbound     fsnotify_mark_destroy_workfn [ 243.686758] Call Trace: [ 243.686762] [c0000000166736e0] [c00000004fd91000]     0xc00000004fd91000 (unreliable) [ 243.686775] [c0000000166738d0] [c00000001001dec0]
    __switch_to+0x130/0x220 [ 243.686788] [c000000016673930] [c000000010f607b8] __schedule+0x1f8/0x
    ---truncated--- (CVE-2023-53671)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-138 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    drm: Fix potential null-ptr-deref due to drmm_mode_config_init() (CVE-2022-50556)

    A double-free vulnerability was found in the handling of IORING_OP_SOCKET operation with io_uring on the     Linux kernel. (CVE-2023-1032)

    Due to a type confusion during initializations, the tun and tap sockets in the Linux Kernel have their     socket UID hardcoded to 0, i.e. root. While it will be often correct, as TUN/TAP devices require     CAP_NET_ADMIN, it may not always be the case. The socket UID may be used for network filtering and     routing, thus TUN/TAP sockets may be incorrectly managed, potentially bypassing network filters based on     UID. (CVE-2023-1076)

    kernel: Type confusion in pick_next_rt_entity(), which can result in memory corruption. (CVE-2023-1077)

    A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the     way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate     their privileges on the system. (CVE-2023-1118)

    A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited     to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate     filters in case of a perfect hashes while deleting the underlying structure which can later lead to double     freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to     root.We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28. (CVE-2023-1829)

    When plain IBRS is enabled (not enhanced IBRS), the logic in spectre_v2_user_select_mitigation()     determines that STIBP is not needed. The IBRS bit implicitly protects against cross-thread branch     targetinjection. However, with legacy IBRS, the IBRS bit is cleared on returning to userspace for     performance reasons which leaves userspace threads vulnerable to cross-thread branch target injection     against which STIBP protects. (CVE-2023-1998)

    A use-after-free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw     could allow a local user to cause a denial of service. (CVE-2023-2985)

    An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker     can trigger a race condition that results in a fill_kobj_path out-of-bounds write. (CVE-2023-45863)

    In the Linux kernel, the following vulnerability has been resolved:

    vfio/type1: prevent underflow of locked_vm via exec() (CVE-2023-53171)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: uhci: fix memory leak with using debugfs_lookup() (CVE-2023-53197)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: x_tables: fix percpu counter block leak on error path when creating new netns (CVE-2023-53200)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: domains: fix memory leak with using debugfs_lookup() (CVE-2023-53202)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: location: Free struct acpi_pld_info *pld before return false (CVE-2023-53211)

    In the Linux kernel, the following vulnerability has been resolved:

    arm64: efi: Make efi_rt_lock a raw_spinlock (CVE-2023-53216)

    In the Linux kernel, the following vulnerability has been resolved:

    watchdog: Fix kmemleak in watchdog_cdev_register (CVE-2023-53234)

    In the Linux kernel, the following vulnerability has been resolved:

    xsk: check IFF_UP earlier in Tx path (CVE-2023-53240)

    In the Linux kernel, the following vulnerability has been resolved:

    firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle (CVE-2023-53250)

    In the Linux kernel, the following vulnerability has been resolved:

    cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (CVE-2023-53254)

    In the Linux kernel, the following vulnerability has been resolved:

    VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF (CVE-2023-53259)

    In the Linux kernel, the following vulnerability has been resolved:

    misc: vmw_balloon: fix memory leak with using debugfs_lookup() (CVE-2023-53279)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Do not update file length for failed writes to inline files (CVE-2023-53295)

    In the Linux kernel, the following vulnerability has been resolved:

    rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails (CVE-2023-53307)

    In the Linux kernel, the following vulnerability has been resolved:

    genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() (CVE-2023-53332)

    In the Linux kernel, the following vulnerability has been resolved:

    USB: fix memory leak with using debugfs_lookup() (CVE-2023-53359)

    In the Linux kernel, the following vulnerability has been resolved:

    block: be a bit more careful in checking for NULL bdev while polling (CVE-2023-53366)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)

    In the Linux kernel, the following vulnerability has been resolved:

    NFSD: fix leaked reference count of nfsd4_ssc_umount_item (CVE-2023-53381)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers: base: dd: fix memory leak with using debugfs_lookup() (CVE-2023-53390)

    In the Linux kernel, the following vulnerability has been resolved:

    trace/blktrace: fix memory leak with using debugfs_lookup() (CVE-2023-53408)

    In the Linux kernel, the following vulnerability has been resolved:

    drivers: base: component: fix memory leak with using debugfs_lookup() (CVE-2023-53409)

    In the Linux kernel, the following vulnerability has been resolved:

    PM: EM: fix memory leak with using debugfs_lookup() (CVE-2023-53411)

    In the Linux kernel, the following vulnerability has been resolved:

    objtool: Fix memory leak in create_static_call_sections() (CVE-2023-53423)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix warning and UAF when destroy the MR list (CVE-2023-53427)

    In the Linux kernel, the following vulnerability has been resolved:

    ipv6: Add lwtunnel encap size of all siblings in nexthop calculation (CVE-2023-53477)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu: Fix error unwind in iommu_group_alloc() (CVE-2023-53482)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: xts - Handle EBUSY correctly (CVE-2023-53494)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Do not bother merging very long extents (CVE-2023-53506)

    In the Linux kernel, the following vulnerability has been resolved:

    io_uring: fix fget leak when fs don't support nowait buffered read (CVE-2023-53511)

    In the Linux kernel, the following vulnerability has been resolved:

    sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop (CVE-2023-53590)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix resource leak in device_add() (CVE-2023-53594)

    In the Linux kernel, the following vulnerability has been resolved:

    nfsd: clean up potential nfsd_file refcount leaks in COPY codepath (CVE-2023-53606)

    In the Linux kernel, the following vulnerability has been resolved:

    irqchip: Fix refcount leak in platform_irqchip_probe (CVE-2023-53610)

    In the Linux kernel, the following vulnerability has been resolved:

    nvme-tcp: don't access released socket during error recovery (CVE-2023-53643)

    In the Linux kernel, the following vulnerability has been resolved:

    srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL (CVE-2023-53671)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/i915: Fix system suspend without fbdev being initialized (CVE-2023-53678)

    In the Linux kernel, the following vulnerability has been resolved:

    udf: Detect system inodes linked into directory hierarchy (CVE-2023-53695)

    In the Linux kernel, the following vulnerability has been resolved:

    ring-buffer: Handle race between rb_move_tail and rb_check_pages (CVE-2023-53709)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: VMX: Fix crash due to uninitialized current_vmcs (CVE-2023-53756)

    In the Linux kernel, the following vulnerability has been resolved:

    dm cache: free background tracker's queued work in btracker_destroy (CVE-2023-53765)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-iocost: fix divide by 0 error in calc_lcoefs() (CVE-2023-53783)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Improve page fault error reporting (CVE-2023-53789)

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Zeroing allocated object from slab in bpf memory allocator (CVE-2023-53790)

    In the Linux kernel, the following vulnerability has been resolved:

    PCI: Fix dropping valid root bus resources with .end = zero (CVE-2023-53814)

    In the Linux kernel, the following vulnerability has been resolved:

    loop: loop_set_status_from_info() check before assignment (CVE-2023-53820)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: early: xhci-dbc: Fix a potential out-of-bound memory access (CVE-2023-53840)

    In the Linux kernel, the following vulnerability has been resolved:

    KVM: Destroy target device if coalesced MMIO unregistration fails (CVE-2023-54024)

    In the Linux kernel, the following vulnerability has been resolved:

    crypto: essiv - Handle EBUSY correctly (CVE-2023-54046)

    In the Linux kernel, the following vulnerability has been resolved:

    iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter (CVE-2023-54057)

    In the Linux kernel, the following vulnerability has been resolved:

    blk-cgroup: dropping parent refcount after pd_free_fn() is done (CVE-2023-54107)

    In the Linux kernel, the following vulnerability has been resolved:

    leds: led-core: Fix refcount leak in of_led_get() (CVE-2023-54190)

    In the Linux kernel, the following vulnerability has been resolved:

    tty: fix out-of-bounds access in tty_driver_lookup_tty() (CVE-2023-54198)

    In the Linux kernel, the following vulnerability has been resolved:

    netfilter: ebtables: fix table blob use-after-free (CVE-2023-54243)

    In the Linux kernel, the following vulnerability has been resolved:

    cifs: Fix lost destroy smbd connection when MR allocate failed (CVE-2023-54260)

    In the Linux kernel, the following vulnerability has been resolved:

    ext4: refuse to create ea block when umounted (CVE-2023-54305)

    In the Linux kernel, the following vulnerability has been resolved:

    net: tls: avoid hanging tasks on the tx_lock (CVE-2023-54306)

    In the Linux kernel, the following vulnerability has been resolved:

    dm flakey: don't corrupt the zero page (CVE-2023-54317)

    In the Linux kernel, the following vulnerability has been resolved:

    driver core: fix potential null-ptr-deref in device_add() (CVE-2023-54321)

    kernel: refcount leak in ctnetlink_create_conntrack() (CVE-2023-7192)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
269287	Linux Distros Unpatched Vulnerability : CVE-2023-53671	Nessus	Misc.	Local	medium
173340	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2023-138)	Nessus	Amazon Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2023-53671

medium

Tenable Plugins

medium

high