Deadlock Vulnerability in Linux Kernel's ENETC Driver - CVE-2023-53022
Summary
CVE-2023-53022: In the Linux kernel, the following vulnerability has been resolved: net: enetc: avoid deadlock in enetc_tx_onestep_tstamp() This lockdep splat says it better than I could: ================================ WARNING: incons... Affects linux versions < 6.1.11-1. Fixed in 6.1.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interactions. The ENETC (Ethernet Network Transmission Controller) driver is responsible for managing Ethernet communications in Linux systems. This driver is crucial for ensuring efficient data transmission over networks. However, it has been found to contain a vulnerability that can lead to a deadlock situation, potentially affecting system stability and performance.
Vulnerability Detail
CVE-2023-53022 is a vulnerability in the Linux kernel's ENETC driver that can cause a deadlock due to improper locking mechanisms. The issue arises when the enetc_tx_onestep_tstamp() function, which runs in process context with softirqs enabled, attempts to acquire the netif_tx_lock() while already holding it. This can lead to a situation where an interrupt occurs, causing the same lock to be requested again, resulting in a deadlock. The ramifications of this vulnerability include system hangs and degraded performance, making it critical to address.
How To Fix
Minimum fixed version
6.1.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the enetc_tx_onestep_tstamp() function to use netif_tx_lock_bh() instead of netif_tx_lock(). This change will prevent softirqs from running while the lock is held, thus avoiding the deadlock scenario.
Conclusion
CVE-2023-53022 is a critical vulnerability in the Linux kernel's ENETC driver that can lead to system deadlocks. It is essential to update to the patched version of the Linux kernel to mitigate this issue. Temporary workarounds are available, but applying the patch is the recommended solution for long-term stability.
See every vulnerability recorded for linux →
FAQ
CVE-2023-53022 is a vulnerability in the Linux kernel's ENETC driver that can lead to a deadlock situation, affecting system stability.
This vulnerability can cause your system to hang or experience degraded performance due to deadlock conditions.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Update your Linux package to version 6.1.11-1 or later to ensure the vulnerability is patched.
Yes, you can modify the enetc_tx_onestep_tstamp() function to use netif_tx_lock_bh() to avoid the deadlock.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
