Kernel Crash Vulnerability in Linux Package: Multi-Gen LRU Cgroup Migration Issue
Summary
CVE-2023-52940: In the Linux kernel, the following vulnerability has been resolved: mm: multi-gen LRU: fix crash during cgroup migration lru_gen_migrate_mm() assumes lru_gen_add_mm() runs prior to itself. Affects linux versions < 6.1.11-1. Fixed in 6.1.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and hardware interactions. It provides essential services for all other parts of the operating system, including process management, memory management, and device control. The vulnerability in question arises from a flaw in the multi-generation least recently used (LRU) memory management system, specifically during cgroup migrations, which can lead to system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the multi-gen LRU memory management system. The function lru_gen_migrate_mm() incorrectly assumes that lru_gen_add_mm() will always execute before it. This assumption can be violated in certain scenarios, leading to a race condition between two CPUs during cgroup migration. When this occurs, it results in linked list corruption of the mm_struct->lru_gen.list, ultimately causing a kernel crash. This vulnerability can severely impact system stability and reliability, especially in environments that rely on cgroup functionalities.
How To Fix
Minimum fixed version
6.1.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is highly recommended to apply the patch as soon as it becomes available to mitigate the risk of system crashes.
Conclusion
The CVE-2023-52940 vulnerability in the Linux kernel poses a significant risk of system crashes due to improper assumptions in the multi-gen LRU memory management system during cgroup migrations. Users are strongly advised to update their Linux packages to the patched version 6.1.11-1 to ensure system stability and security.
See every vulnerability recorded for linux →
FAQ
CVE-2023-52940 is a vulnerability in the Linux kernel related to the multi-gen LRU memory management system, which can lead to kernel crashes during cgroup migrations.
This vulnerability can cause system instability and crashes, particularly in environments that utilize cgroups for resource management.
Yes, a patch is available in version 6.1.11-1 for Debian 12 and 13. Users should update their Linux package to this version to fix the vulnerability.
While there are no specific workarounds, it is crucial to monitor your system closely and apply the patch as soon as possible to avoid potential crashes.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application for this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
