Look up another CVE · open CVE-2023-53823 in the interactive tracker
CVE-2023-53823
block/rq_qos: protect rq_qos apis with a new lock
Published 2025-12-09 (10 months ago) by the Linux kernel CNA. Subsystem block. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2023-53823 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixed | 6.4.4-1 | Update the kernel and reboot. Fixed in 6.4.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 6.4.4-1 | Update the kernel and reboot. Fixed in 6.4.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.4.4-1 | Update the kernel and reboot. Fixed in 6.4.4-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
commit 50e34d78815e ("block: disable the elevator int del_gendisk") move rq_qos_exit() from disk_release() to del_gendisk(), this will introduce some problems: 1) If rq_qos_add() is triggered by enabling iocost/iolatency through cgroupfs, then it can concurrent with del_gendisk(), it's not safe to write 'q->rq_qos' concurrently. 2) Activate cgroup policy that is relied on rq_qos will call rq_qos_add() and blkcg_activate_policy(), and if rq_qos_exit() is called in the middle, null-ptr-dereference will be triggered in blkcg_activate_policy(). 3) blkg_conf_open_bdev() can call blkdev_get_no_open() first to find the disk, then if rq_qos_exit() from del_gendisk() is done before rq_qos_add(), then memory will be leaked. This patch add a new disk level mutex 'rq_qos_mutex': 1) The lock will protect rq_qos_exit() directly. 2) For wbt that doesn't relied on blk-cgroup, rq_qos_add() can only be called from disk initialization for now because wbt can't be destructed until rq_qos_exit(), so it's safe not to protect wbt for now. Hoever, in case that rq_qos dynamically destruction is supported in the furture, this patch also protect rq_qos_add() from wbt_init() directly, this is enough because blk-sysfs already synchronize writers with disk removal. 3) For iocost and iolatency, in order to synchronize disk removal and cgroup configuration, the lock is held after blkdev_get_no_open() from blkg_conf_open_bdev(), and is released in blkg_conf_exit(). In order to fix the above memory leak, disk_live() is checked after holding the new lock.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
block/blk-cgroup.c
block/blk-core.c
block/blk-rq-qos.c
block/blk-wbt.c
include/linux/blkdev.h
- What this is
- CONTROL GROUP - BLOCK IO CONTROLLER (BLKIO)MAINTAINERS section matched on block/blk-cgroup.c · cgroups@vger.kernel.org
Check it on the machine
grep -w CONFIG_BLK_CGROUP /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_BLK_CGROUP
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2025-12-09 (10 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 7.4% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- block
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.19 | 6.4.4 | 16398b4638b5 |
| 5.19 | 6.5 | a13bd91be223 |
| 5.18.8 | 0 | 0 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Both sides of the race are driven through local interfaces — a cgroupfs write to `io.latency`/`io.cost.qos` reaching `rq_qos_add()`, and a block-device removal reaching `del_gendisk()`→`rq_qos_exit()`. There is no remote or network-facing path into the block rq_qos layer.
- AC:LAttack complexity, low
- The attacker controls both sides: they can loop the `io.latency` write against any device by MAJ:MIN (no permission check in `blkg_conf_open_bdev()`) while triggering repeated disk teardown (loop/nbd device delete), and can stretch the `rq_qos_add()`→`timer_setup()` window arbitrarily by populating the queue with thousands of blkgs so `blkcg_activate_policy()` spends a long time in GFP_KERNEL allocation and retry.
- PR:LPrivileges required, low
- No capability check exists on the path — `iolatency_set_limit()`/`blkg_conf_open_bdev()` gate only on cgroupfs file permissions, and `cgroup_add_file()` creates interface files owned by `current_fsuid()`, so an unprivileged user with a delegated cgroup v2 subtree (systemd delegation, container runtimes) can write `io.latency` and target any block device on the system.
- UI:NUser interaction, none
- The attacker performs both the cgroup configuration write and the disk removal themselves; no action by any other user or administrator is needed.
- S:UScope, unchanged
- The corruption is confined to kernel heap objects and the block layer's request_queue within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.
- C:HConfidentiality impact, high
- The unsynchronized `q->rq_qos` update leaves freed `rq_qos` objects linked in the chain and dangling `blk_iolatency`/gendisk pointers, giving a use-after-free read primitive over reclaimed slab memory that can be groomed to disclose arbitrary kernel data.
- I:HIntegrity impact, high
- `blk_iolatency_init()` continues writing (`timer_setup()`, `INIT_WORK()`) into the object already freed by `blkcg_iolatency_exit()`, and `__rq_qos_throttle()` performs an indirect call through `rqos->ops->throttle` read from freed memory — a heap-spray-controllable arbitrary write and control-flow hijack.
- A:HAvailability impact, high
- The race reliably produces kernel oopses — a NULL dereference through `iolat->blkiolat` set to NULL by `iolatency_pd_init()`, plus use-after-free faults on the rq_qos chain during I/O submission and from the leaked object's timer firing after the disk is released.