In the Linux kernel, the following vulnerability has been resolved:
net: fix possible store tearing in neighperiodicwork()
While looking at a related syzbot report involving neighperiodicwork(), I found that I forgot to add an annotation when deleting an RCU protected item from a list.
Readers use rcudeference(*np), we need to use either rcuassignpointer() or WRITEONCE() on writer side to prevent store tearing.
I use rcuassignpointer() to have lockdep support, this was the choice made in neighflushdev().
{ "vanir_signatures": [ { "id": "CVE-2023-52522-13a0b944", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95eabb075a5902f4c0834ab1fb12dc35730c05af", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 1761.0, "function_hash": "252065893535178019771669688610059256393" }, "target": { "file": "net/core/neighbour.c", "function": "neigh_periodic_work" } }, { "id": "CVE-2023-52522-26fc4124", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a75152d233370362eebedb2643592e7c883cc9fc", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 1761.0, "function_hash": "252065893535178019771669688610059256393" }, "target": { "file": "net/core/neighbour.c", "function": "neigh_periodic_work" } }, { "id": "CVE-2023-52522-2c510c0f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ea52a2fb8e87067e26bbab4efb8872639240eb0", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 1761.0, "function_hash": "252065893535178019771669688610059256393" }, "target": { "file": "net/core/neighbour.c", "function": "neigh_periodic_work" } }, { "id": "CVE-2023-52522-483dc7ff", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a75152d233370362eebedb2643592e7c883cc9fc", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "123603784311841812992857975729282614217", "240691631107732376721445850212060815589", "257049473553259657974544596108164873450", "16708528366064761810096109105491843477" ] }, "target": { "file": "net/core/neighbour.c" } }, { "id": "CVE-2023-52522-4a2bf6ed", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25563b581ba3a1f263a00e8c9a97f5e7363be6fd", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 1761.0, "function_hash": "252065893535178019771669688610059256393" }, "target": { "file": "net/core/neighbour.c", "function": "neigh_periodic_work" } }, { "id": "CVE-2023-52522-60f8c28a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f82aac8162871e87027692b36af335a2375d4580", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 1761.0, "function_hash": "252065893535178019771669688610059256393" }, "target": { "file": "net/core/neighbour.c", "function": "neigh_periodic_work" } }, { "id": "CVE-2023-52522-a1c854d2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f82aac8162871e87027692b36af335a2375d4580", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "123603784311841812992857975729282614217", "240691631107732376721445850212060815589", "257049473553259657974544596108164873450", "16708528366064761810096109105491843477" ] }, "target": { "file": "net/core/neighbour.c" } }, { "id": "CVE-2023-52522-b3bf8e1b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@147d89ee41434b97043c2dcb17a97dc151859baa", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "123603784311841812992857975729282614217", "240691631107732376721445850212060815589", "257049473553259657974544596108164873450", "16708528366064761810096109105491843477" ] }, "target": { "file": "net/core/neighbour.c" } }, { "id": "CVE-2023-52522-bbc2637b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@147d89ee41434b97043c2dcb17a97dc151859baa", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 1761.0, "function_hash": "252065893535178019771669688610059256393" }, "target": { "file": "net/core/neighbour.c", "function": "neigh_periodic_work" } }, { "id": "CVE-2023-52522-c08d63a4", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ea52a2fb8e87067e26bbab4efb8872639240eb0", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "123603784311841812992857975729282614217", "240691631107732376721445850212060815589", "257049473553259657974544596108164873450", "16708528366064761810096109105491843477" ] }, "target": { "file": "net/core/neighbour.c" } }, { "id": "CVE-2023-52522-d56dafaa", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25563b581ba3a1f263a00e8c9a97f5e7363be6fd", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "123603784311841812992857975729282614217", "240691631107732376721445850212060815589", "257049473553259657974544596108164873450", "16708528366064761810096109105491843477" ] }, "target": { "file": "net/core/neighbour.c" } }, { "id": "CVE-2023-52522-f4fc84d3", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95eabb075a5902f4c0834ab1fb12dc35730c05af", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "123603784311841812992857975729282614217", "240691631107732376721445850212060815589", "257049473553259657974544596108164873450", "16708528366064761810096109105491843477" ] }, "target": { "file": "net/core/neighbour.c" } } ] }