CVE-2023-53481

In the Linux kernel, the following vulnerability has been resolved:

ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed

Following process will trigger an infinite loop in ubi_wl_put_peb():

ubifs_bgt		ubi_bgt

ubifs_leb_unmap ubi_leb_unmap ubi_eba_unmap_leb ubi_wl_put_peb wear_leveling_worker e1 = rb_entry(rb_first(&ubi->used) e2 = get_peb_for_wl(ubi) ubi_io_read_vid_hdr // return err (flash fault) out_error: ubi->move_from = ubi->move_to = NULL wl_entry_destroy(ubi, e1) ubi->lookuptbl[e->pnum] = NULL retry: e = ubi->lookuptbl[pnum]; // return NULL if (e == ubi->move_from) { // NULL == NULL gets true goto retry; // infinite loop !!!

$ top PID USER PR NI VIRT RES SHR S %CPU %MEM COMMAND 7676 root 20 0 0 0 0 R 100.0 0.0 ubifs_bgt0_0

Fix it by:

1. Letting ubi_wl_put_peb() returns directly if wearl leveling entry has been removed from 'ubi->lookuptbl'.
2. Using 'ubi->wl_lock' protecting wl entry deletion to preventing an use-after-free problem for wl entry in ubi_wl_put_peb().

Fetch a reproducer in [Link].

The patch fixes two issues in UBI wear-leveling: an infinite loop in ubi_wl_put_peb() when the WL entry disappears, and a potential race/UAF by destroying WL entries outside wl_lock. Practical impact is availability only: a kernel background thread can spin at 100% CPU (and, under race, risk UAF) on systems using UBI/UBIFS. For the CVSS the PR:L because a local user with write access to a UBIFS volume can naturally trigger wear-leveling paths (file churn/GC). In locked-down deployments where only admins can mount/write or induce I/O faults, PR:H applies since triggering requires privileged operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.