System Hang on Reboot in Linux Kernel due to iavf Driver Issue
Summary
CVE-2023-53064: In the Linux kernel, the following vulnerability has been resolved: iavf: fix hang on reboot with ice When a system with E810 with existing VFs gets rebooted the following hang may be observed. Affects linux versions < 6.1.25-1. Fixed in 6.1.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of hardware architectures and is known for its stability and performance. The iavf driver is responsible for managing Intel's Ethernet devices, specifically those utilizing the E810 architecture. This driver facilitates the creation and management of Virtual Functions (VFs) for network virtualization. However, a recent vulnerability has been identified that can cause the system to hang during reboot when existing VFs are present.
Vulnerability Detail
The vulnerability, identified as CVE-2023-53064, occurs when a system with E810 hardware and existing Virtual Functions (VFs) is rebooted. During the reboot process, the iavf driver attempts to remove the VFs, but if the adapter state is already set to __IAVF_REMOVE, the iavf_remove() function enters an indefinite sleep state, causing the system to hang. This issue arises because the iavf_remove() function expects the VF to be in specific states (running, down, or init failed) and does not handle the __IAVF_REMOVE state correctly. The ramifications of this vulnerability include potential downtime and system unavailability, particularly in environments where uptime is critical.
How To Fix
Minimum fixed version
6.1.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2023-53064 represents a significant vulnerability in the Linux kernel that can lead to system hangs during reboot. It is crucial for users to update their systems to the patched version to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system integrity and security.
See every vulnerability recorded for linux →
FAQ
CVE-2023-53064 is a vulnerability in the Linux kernel that can cause the system to hang during reboot when using the iavf driver with existing Virtual Functions.
Systems utilizing the Linux kernel with the iavf driver, particularly those with Intel E810 hardware and existing Virtual Functions, are affected.
You can use Vulert, a tool that monitors open-source vulnerabilities. By uploading your manifest file, you can check if your application is affected by CVE-2023-53064.
The primary consequence is that the system may hang indefinitely during reboot, leading to potential downtime and disruption of services.
Yes, a patch is available in the form of an updated Linux kernel package. Users are advised to update to version 6.1.25-1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
