CVE-2023-53111

In the Linux kernel, the following vulnerability has been resolved:

loop: Fix use-after-free issues

do_req_filebacked() calls blk_mq_complete_request() synchronously or asynchronously when using asynchronous I/O unless memory allocation fails. Hence, modify loop_handle_cmd() such that it does not dereference 'cmd' nor 'rq' after do_req_filebacked() finished unless we are sure that the request has not yet been completed. This patch fixes the following kernel crash:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000054 Call trace: css_put.42938+0x1c/0x1ac loop_process_work+0xc8c/0xfd4 loop_rootcg_workfn+0x24/0x34 process_one_work+0x244/0x558 worker_thread+0x400/0x8fc kthread+0x16c/0x1e0 ret_from_fork+0x10/0x20

This vulnerability is rated as Moderate severity rather than Important because exploitation requires local access with elevated privileges to configure and execute asynchronous I/O operations against loop block devices. Under default Red Hat Enterprise Linux deployments, non-root users cannot manage or attach loop devices without dedicated privileges such as CAP_SYS_ADMIN. Consequently, the primary operational impact is restricted to a local denial of service from a kernel crash, without direct exposure to remote attackers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.