In the Linux kernel, the following vulnerability has been resolved:
ubi: ubiwlput_peb: Fix infinite loop when wear-leveling work failed
Following process will trigger an infinite loop in ubiwlput_peb():
ubifs_bgt ubi_bgt
ubifslebunmap ubilebunmap ubiebaunmapleb ubiwlputpeb wearlevelingworker e1 = rbentry(rbfirst(&ubi->used) e2 = getpebforwl(ubi) ubiioreadvidhdr // return err (flash fault) outerror: ubi->movefrom = ubi->moveto = NULL wlentrydestroy(ubi, e1) ubi->lookuptbl[e->pnum] = NULL retry: e = ubi->lookuptbl[pnum]; // return NULL if (e == ubi->move_from) { // NULL == NULL gets true goto retry; // infinite loop !!!
$ top PID USER PR NI VIRT RES SHR S %CPU %MEM COMMAND 7676 root 20 0 0 0 0 R 100.0 0.0 ubifsbgt00
Fix it by: 1) Letting ubiwlputpeb() returns directly if wearl leveling entry has been removed from 'ubi->lookuptbl'. 2) Using 'ubi->wllock' protecting wl entry deletion to preventing an use-after-free problem for wl entry in ubiwlput_peb().
Fetch a reproducer in [Link].
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53481.json",
"cna_assigner": "Linux"
}[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3afaaf6f5867dc4ad383808d4053f428ec7b867d",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/mtd/ubi/wl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"183703722426247344489234815340602254132",
"196035369859132202317060735400658038694",
"183897834708219588138233492176885944116",
"21454997923499653464331534343985122454",
"261452113933689180673180741703709441477",
"22573501019015634856659503980715113316",
"24299708065890569594911064139730912268",
"259633932465458974270881257376792186792",
"299671918062343054378527513302654328383",
"70579562119648458836641301457846167117",
"107528512521554357810051093061849650679",
"131004709628718243379917677039791795480"
]
},
"signature_version": "v1",
"id": "CVE-2023-53481-18f1dbf5"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5be23f6ae610bdb262160a1f294afee6d0e6a69",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/mtd/ubi/wl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"183703722426247344489234815340602254132",
"196035369859132202317060735400658038694",
"183897834708219588138233492176885944116",
"21454997923499653464331534343985122454",
"261452113933689180673180741703709441477",
"22573501019015634856659503980715113316",
"24299708065890569594911064139730912268",
"259633932465458974270881257376792186792",
"299671918062343054378527513302654328383",
"70579562119648458836641301457846167117",
"107528512521554357810051093061849650679",
"131004709628718243379917677039791795480"
]
},
"signature_version": "v1",
"id": "CVE-2023-53481-1af3514e"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc4bc532acda66189bddc03b3fe1ad689d9a48a2",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/mtd/ubi/wl.c",
"function": "wear_leveling_worker"
},
"digest": {
"length": 6716.0,
"function_hash": "183239098790372111699465325238967891610"
},
"signature_version": "v1",
"id": "CVE-2023-53481-1e7f98e9"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3afaaf6f5867dc4ad383808d4053f428ec7b867d",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/mtd/ubi/wl.c",
"function": "ubi_wl_put_peb"
},
"digest": {
"length": 1837.0,
"function_hash": "140164018090453541323913666954056540702"
},
"signature_version": "v1",
"id": "CVE-2023-53481-3973e4e9"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b40d2fbf47af58377e898b5062077a47bb28a132",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/mtd/ubi/wl.c",
"function": "ubi_wl_put_peb"
},
"digest": {
"length": 1837.0,
"function_hash": "140164018090453541323913666954056540702"
},
"signature_version": "v1",
"id": "CVE-2023-53481-3a932909"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b40d2fbf47af58377e898b5062077a47bb28a132",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/mtd/ubi/wl.c",
"function": "wear_leveling_worker"
},
"digest": {
"length": 6448.0,
"function_hash": "194841116775632482956565694827069335825"
},
"signature_version": "v1",
"id": "CVE-2023-53481-44677790"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a18856e074479bd050b01e688c58defadce7ab0",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/mtd/ubi/wl.c",
"function": "wear_leveling_worker"
},
"digest": {
"length": 6634.0,
"function_hash": "130758279469279172014978317259173694281"
},
"signature_version": "v1",
"id": "CVE-2023-53481-484e5531"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc4bc532acda66189bddc03b3fe1ad689d9a48a2",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/mtd/ubi/wl.c",
"function": "ubi_wl_put_peb"
},
"digest": {
"length": 1837.0,
"function_hash": "140164018090453541323913666954056540702"
},
"signature_version": "v1",
"id": "CVE-2023-53481-56707de3"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc4bc532acda66189bddc03b3fe1ad689d9a48a2",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/mtd/ubi/wl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"183703722426247344489234815340602254132",
"196035369859132202317060735400658038694",
"183897834708219588138233492176885944116",
"21454997923499653464331534343985122454",
"261452113933689180673180741703709441477",
"22573501019015634856659503980715113316",
"24299708065890569594911064139730912268",
"259633932465458974270881257376792186792",
"299671918062343054378527513302654328383",
"70579562119648458836641301457846167117",
"107528512521554357810051093061849650679",
"131004709628718243379917677039791795480"
]
},
"signature_version": "v1",
"id": "CVE-2023-53481-656161bd"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a18856e074479bd050b01e688c58defadce7ab0",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/mtd/ubi/wl.c",
"function": "ubi_wl_put_peb"
},
"digest": {
"length": 1837.0,
"function_hash": "140164018090453541323913666954056540702"
},
"signature_version": "v1",
"id": "CVE-2023-53481-665a4517"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3afaaf6f5867dc4ad383808d4053f428ec7b867d",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/mtd/ubi/wl.c",
"function": "wear_leveling_worker"
},
"digest": {
"length": 6634.0,
"function_hash": "130758279469279172014978317259173694281"
},
"signature_version": "v1",
"id": "CVE-2023-53481-6e4217b8"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f006f596fe851c3b6aae60b79f89f89f0e515d2f",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/mtd/ubi/wl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"183703722426247344489234815340602254132",
"196035369859132202317060735400658038694",
"183897834708219588138233492176885944116",
"21454997923499653464331534343985122454",
"261452113933689180673180741703709441477",
"22573501019015634856659503980715113316",
"24299708065890569594911064139730912268",
"259633932465458974270881257376792186792",
"299671918062343054378527513302654328383",
"70579562119648458836641301457846167117",
"107528512521554357810051093061849650679",
"131004709628718243379917677039791795480"
]
},
"signature_version": "v1",
"id": "CVE-2023-53481-6eb29c21"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8a18856e074479bd050b01e688c58defadce7ab0",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/mtd/ubi/wl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"183703722426247344489234815340602254132",
"196035369859132202317060735400658038694",
"183897834708219588138233492176885944116",
"21454997923499653464331534343985122454",
"261452113933689180673180741703709441477",
"22573501019015634856659503980715113316",
"24299708065890569594911064139730912268",
"259633932465458974270881257376792186792",
"299671918062343054378527513302654328383",
"70579562119648458836641301457846167117",
"107528512521554357810051093061849650679",
"131004709628718243379917677039791795480"
]
},
"signature_version": "v1",
"id": "CVE-2023-53481-79f36ec6"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5af1c643184a5d09ff5b3f334077a4d0a163c677",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/mtd/ubi/wl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"183703722426247344489234815340602254132",
"196035369859132202317060735400658038694",
"183897834708219588138233492176885944116",
"21454997923499653464331534343985122454",
"261452113933689180673180741703709441477",
"22573501019015634856659503980715113316",
"24299708065890569594911064139730912268",
"259633932465458974270881257376792186792",
"299671918062343054378527513302654328383",
"70579562119648458836641301457846167117",
"107528512521554357810051093061849650679",
"131004709628718243379917677039791795480"
]
},
"signature_version": "v1",
"id": "CVE-2023-53481-7c32a86d"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b40d2fbf47af58377e898b5062077a47bb28a132",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/mtd/ubi/wl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"183703722426247344489234815340602254132",
"196035369859132202317060735400658038694",
"183897834708219588138233492176885944116",
"21454997923499653464331534343985122454",
"261452113933689180673180741703709441477",
"22573501019015634856659503980715113316",
"24299708065890569594911064139730912268",
"259633932465458974270881257376792186792",
"299671918062343054378527513302654328383",
"70579562119648458836641301457846167117",
"107528512521554357810051093061849650679",
"131004709628718243379917677039791795480"
]
},
"signature_version": "v1",
"id": "CVE-2023-53481-7e2ede42"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f006f596fe851c3b6aae60b79f89f89f0e515d2f",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/mtd/ubi/wl.c",
"function": "ubi_wl_put_peb"
},
"digest": {
"length": 1837.0,
"function_hash": "140164018090453541323913666954056540702"
},
"signature_version": "v1",
"id": "CVE-2023-53481-939eddb5"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5af1c643184a5d09ff5b3f334077a4d0a163c677",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/mtd/ubi/wl.c",
"function": "wear_leveling_worker"
},
"digest": {
"length": 6716.0,
"function_hash": "183239098790372111699465325238967891610"
},
"signature_version": "v1",
"id": "CVE-2023-53481-9977e381"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d57a7333e26040f2b583983e1970d9d460e56b0",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/mtd/ubi/wl.c",
"function": "ubi_wl_put_peb"
},
"digest": {
"length": 1837.0,
"function_hash": "140164018090453541323913666954056540702"
},
"signature_version": "v1",
"id": "CVE-2023-53481-b4d32177"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d57a7333e26040f2b583983e1970d9d460e56b0",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/mtd/ubi/wl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"183703722426247344489234815340602254132",
"196035369859132202317060735400658038694",
"183897834708219588138233492176885944116",
"21454997923499653464331534343985122454",
"261452113933689180673180741703709441477",
"22573501019015634856659503980715113316",
"24299708065890569594911064139730912268",
"259633932465458974270881257376792186792",
"299671918062343054378527513302654328383",
"70579562119648458836641301457846167117",
"107528512521554357810051093061849650679",
"131004709628718243379917677039791795480"
]
},
"signature_version": "v1",
"id": "CVE-2023-53481-bfad8194"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5be23f6ae610bdb262160a1f294afee6d0e6a69",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/mtd/ubi/wl.c",
"function": "wear_leveling_worker"
},
"digest": {
"length": 6448.0,
"function_hash": "117781721908775397429674430350682797016"
},
"signature_version": "v1",
"id": "CVE-2023-53481-c5fc93fd"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5af1c643184a5d09ff5b3f334077a4d0a163c677",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/mtd/ubi/wl.c",
"function": "ubi_wl_put_peb"
},
"digest": {
"length": 1837.0,
"function_hash": "140164018090453541323913666954056540702"
},
"signature_version": "v1",
"id": "CVE-2023-53481-ca8b7d69"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d57a7333e26040f2b583983e1970d9d460e56b0",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/mtd/ubi/wl.c",
"function": "wear_leveling_worker"
},
"digest": {
"length": 6716.0,
"function_hash": "183239098790372111699465325238967891610"
},
"signature_version": "v1",
"id": "CVE-2023-53481-d8035fc0"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f006f596fe851c3b6aae60b79f89f89f0e515d2f",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/mtd/ubi/wl.c",
"function": "wear_leveling_worker"
},
"digest": {
"length": 6392.0,
"function_hash": "63946213156744190557300268301512522781"
},
"signature_version": "v1",
"id": "CVE-2023-53481-e477834f"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b5be23f6ae610bdb262160a1f294afee6d0e6a69",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/mtd/ubi/wl.c",
"function": "ubi_wl_put_peb"
},
"digest": {
"length": 1837.0,
"function_hash": "140164018090453541323913666954056540702"
},
"signature_version": "v1",
"id": "CVE-2023-53481-f3b06cdc"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53481.json"