CXL Subsystem Vulnerability in Linux Package: Race Condition in Endpoint Deletion
Summary
DEBIAN-CVE-2023-52771: In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix delete_endpoint() vs parent unregistration race The CXL subsystem, at cxl_mem ->probe() time, establishes a lineage of ports (struct cxl_p... Affects linux versions < 6.6.8-1. Fixed in 6.6.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. It supports a wide range of functionalities, including device drivers, file systems, and network protocols. The kernel's CXL (Compute Express Link) subsystem is responsible for managing memory devices and their connections. This vulnerability arises from a race condition during the deletion of endpoint ports, potentially leading to system instability and security risks.
Vulnerability Detail
In the Linux kernel, a race condition exists in the CXL subsystem during the deletion of endpoint ports. When a port in the lineage of a CXL topology is removed, the delete_endpoint() callback must ensure that it is correctly managing the hierarchy of ports. Failure to properly lock the parent device can lead to use-after-free scenarios, resulting in critical errors such as spinlock corruption. This vulnerability can cause system crashes and unpredictable behavior, particularly in environments utilizing CXL memory devices.
How To Fix
Minimum fixed version
6.6.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risks associated with this issue.
Conclusion
The vulnerability identified in the Linux kernel's CXL subsystem poses significant risks due to a race condition during endpoint deletion. Users are advised to update to the patched version 6.6.8-1 to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a race condition in the CXL subsystem of the Linux kernel that can lead to system instability when deleting endpoint ports.
If you are using Debian 13 or 14 with the Linux kernel version prior to 6.6.8-1, your system may be affected by this vulnerability.
Exploiting this vulnerability could lead to system crashes, unpredictable behavior, and potential security risks due to improper memory management.
Yes, a patch is available in version 6.6.8-1 of the Linux package. It is recommended to update to this version to fix the vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application for vulnerabilities without signup at the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
