CVE-2023-54107

A flaw was found in the Linux kernel's block cgroup (blk-cgroup) component. A local attacker, by creating and tearing down cgroups and triggering block cgroup policy activity, could exploit a use-after-free vulnerability. This occurs due to the asynchronous execution of pd_free_fn, which can prematurely free parent policy data while child policies may still access it. This could lead to a stale pointer dereference, potentially causing a denial of service (DoS).

A use after free risk exists in blk cgroup policy data lifetime because pd_free_fn runs asynchronously in blkg_free_workfn and some policies may still access parent policy data through a child even after pd_offline_fn has completed. If the parent blkg reference is dropped too early the parent policy data can be freed before the child cleanup runs. This can lead to a stale pointer dereference when the child cleanup path or policy logic accesses the already freed parent data. For the CVSS the PR:L choice reflects that a local attacker needs the ability to create and tear down cgroups and trigger block cgroup policy activity, which can be delegated in some container setups.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.