CVE-2023-52522 net: fix possible store tearing in neigh_periodic_work()
A race condition in the Linux kernel networking stack can cause store tearing, potentially leading to system instability or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52522?
CVE-2023-52522 is a high-severity vulnerability in Linux kernel, published on 2 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: fix possible store tearing in neigh_periodic_work()
While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item from a list.
Readers use rcu_deference(*np), we need to use either rcu_assign_pointer() or WRITE_ONCE() on writer side to prevent store tearing.
I use rcu_assign_pointer() to have lockdep support, this was the choice made in neigh_flush_dev().
Which versions are affected by CVE-2023-52522?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-52522?
Apply the vendor's patch.
Is CVE-2023-52522 being exploited?
There is no known exploitation of CVE-2023-52522 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-52522, DEBIAN-CVE-2023-52522, GHSA-f8jx-pmvg-jgfh, UBUNTU-CVE-2023-52522.