CVE-2023-54107

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Triggering requires local cgroup filesystem operations (mkdir/rmdir of nested cgroups, writes to io.max/io.weight/io.latency) plus block I/O to populate blkgs. There is no remote or adjacent-network path into blk-cgroup teardown.

AC:LAttack complexity, low

Although the UAF arises from unordered asynchronous work items and timers, the attacker controls both sides — building the nested blkcg hierarchy, choosing the tear-down order and timing, looping thousands of create/destroy cycles, and loading system_wq to widen the window while pd_free_fn sleeps (hrtimer_cancel, blk_put_queue). The iocost/throttle timers also fire on their own, so the window recurs without any condition outside attacker influence.

PR:LPrivileges required, low

An unprivileged local account with a delegated cgroup v2 subtree suffices — standard systemd user slices and rootless/OCI containers grant mkdir/rmdir plus ownership of the non-root io.max, io.weight and io.latency files in cgroups the user creates, and bfq/blk-throttle policies are active without any privileged setup. No real root in the initial namespace is needed.

UI:NUser interaction, none

The attacker performs the entire sequence — cgroup creation, I/O generation, and rmdir — in its own process with no action by any other user.

S:UScope, unchanged

The corruption is confined to kernel heap objects managed by the same kernel security authority; no VM, hypervisor, or IOMMU boundary is crossed.

C:HConfidentiality impact, high

The freed parent ioc_gq/throtl_grp/bfq_group lives in a general kmalloc cache, and __propagate_weights()/current_hweight() read child_active_sum, child_inuse_sum, active and inuse straight out of the reclaimed slot, with results observable via io.stat and scheduling behaviour. Heap grooming turns this into a controllable kernel-memory disclosure primitive.

I:HIntegrity impact, high

__propagate_weights() performs read-modify-write arithmetic directly on the freed parent object (parent->child_active_sum += ..., parent->child_inuse_sum += ...) with deltas derived from attacker-chosen io.weight values, and throtl_rb_erase() writes rb-tree pointers into the freed parent service queue. Sprayed into an attacker-chosen reclaimed object, this is a write primitive leading to control-flow hijack and privilege escalation.

A:HAvailability impact, high

Use-after-free access and modification of freed slab memory reliably produces KASAN splats, rb-tree/slab corruption, and kernel oops or panic, and the sequence can be repeated at will to crash the machine.