CVE-2023-52516

一、漏洞信息
 漏洞编号：[CVE-2023-52516](https://nvd.nist.gov/vuln/detail/CVE-2023-52516)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0
 CVSS V2.0分值：
  BaseScore：0.0 Low
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:dma-debug: don t call __dma_entry_alloc_check_leak() under free_entries_lock__dma_entry_alloc_check_leak() calls into printk -> serial consoleoutput (qcom geni) and grabs port->lock under free_entries_lockspin lock, which is a reverse locking dependency chain as qcom_geniIRQ handler can call into dma-debug code and grab free_entries_lockunder port->lock.Move __dma_entry_alloc_check_leak() call out of free_entries_lockscope so that we don t acquire serial console s port->lock under it.Trimmed-down lockdep splat: The existing dependency chain (in reverse order) is:               -> #2 (free_entries_lock){-.-.}-{2:2}:        _raw_spin_lock_irqsave+0x60/0x80        dma_entry_alloc+0x38/0x110        debug_dma_map_page+0x60/0xf8        dma_map_page_attrs+0x1e0/0x230        dma_map_single_attrs.constprop.0+0x6c/0xc8        geni_se_rx_dma_prep+0x40/0xcc        qcom_geni_serial_isr+0x310/0x510        __handle_irq_event_percpu+0x110/0x244        handle_irq_event_percpu+0x20/0x54        handle_irq_event+0x50/0x88        handle_fasteoi_irq+0xa4/0xcc        handle_irq_desc+0x28/0x40        generic_handle_domain_irq+0x24/0x30        gic_handle_irq+0xc4/0x148        do_interrupt_handler+0xa4/0xb0        el1_interrupt+0x34/0x64        el1h_64_irq_handler+0x18/0x24        el1h_64_irq+0x64/0x68        arch_local_irq_enable+0x4/0x8        ____do_softirq+0x18/0x24        ...               -> #1 (&port_lock_key){-.-.}-{2:2}:        _raw_spin_lock_irqsave+0x60/0x80        qcom_geni_serial_console_write+0x184/0x1dc        console_flush_all+0x344/0x454        console_unlock+0x94/0xf0        vprintk_emit+0x238/0x24c        vprintk_default+0x3c/0x48        vprintk+0xb4/0xbc        _printk+0x68/0x90        register_console+0x230/0x38c        uart_add_one_port+0x338/0x494        qcom_geni_serial_probe+0x390/0x424        platform_probe+0x70/0xc0        really_probe+0x148/0x280        __driver_probe_device+0xfc/0x114        driver_probe_device+0x44/0x100        __device_attach_driver+0x64/0xdc        bus_for_each_drv+0xb0/0xd8        __device_attach+0xe4/0x140        device_initial_probe+0x1c/0x28        bus_probe_device+0x44/0xb0        device_add+0x538/0x668        of_device_add+0x44/0x50        of_platform_device_create_pdata+0x94/0xc8        of_platform_bus_create+0x270/0x304        of_platform_populate+0xac/0xc4        devm_of_platform_populate+0x60/0xac        geni_se_probe+0x154/0x160        platform_probe+0x70/0xc0        ...               -> #0 (console_owner){-...}-{0:0}:        __lock_acquire+0xdf8/0x109c        lock_acquire+0x234/0x284        console_flush_all+0x330/0x454        console_unlock+0x94/0xf0        vprintk_emit+0x238/0x24c        vprintk_default+0x3c/0x48        vprintk+0xb4/0xbc        _printk+0x68/0x90        dma_entry_alloc+0xb4/0x110        debug_dma_map_sg+0xdc/0x2f8        __dma_map_sg_attrs+0xac/0xe4        dma_map_sgtable+0x30/0x4c        get_pages+0x1d4/0x1e4 [msm]        msm_gem_pin_pages_locked+0x38/0xac [msm]        msm_gem_pin_vma_locked+0x58/0x88 [msm]        msm_ioctl_gem_submit+0xde4/0x13ac [msm]        drm_ioctl_kernel+0xe0/0x15c        drm_ioctl+0x2e8/0x3f4        vfs_ioctl+0x30/0x50        ... Chain exists of:   console_owner --> &port_lock_key --> free_entries_lock  Possible unsafe locking scenario:        CPU0                    CPU1        ----                    ----   lock(free_entries_lock);                                lock(&port_lock_key);                                lock(free_entries_lock);   lock(console_owner);                *** DEADLOCK *** Call trace:  dump_backtrace+0xb4/0xf0  show_stack+0x20/0x30  dump_stack_lvl+0x60/0x84  dump_stack+0x18/0x24  print_circular_bug+0x1cc/0x234  check_noncircular+0x78/0xac  __lock_acquire+0xdf8/0x109c  lock_acquire+0x234/0x284  console_flush_all+0x330/0x454  consol---truncated---
 漏洞公开时间：2024-03-03 06:15:47
 漏洞创建时间：2024-03-03 08:40:17
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-52516
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/ac0d068099349cbca3d93f2e3b15bb329364b08c |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/be8f49029eca3efbad0d74dbff3cb9129994ffab |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c79300599923daaa30f417c75555d5566b3d31ae |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/fb5a4315591dae307a65fc246ca80b5159d296e1 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/fe2b811a02c3244ebf6059039e4a9e715e26a9e3 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52516 | https://bugzilla.suse.com/show_bug.cgi?id=1221035 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-52516 | https://bugzilla.suse.com/show_bug.cgi?id=1221035 |
| suse_bugzilla | https://git.kernel.org/stable/c/ac0d068099349cbca3d93f2e3b15bb329364b08c | https://bugzilla.suse.com/show_bug.cgi?id=1221035 |
| suse_bugzilla | https://git.kernel.org/stable/c/be8f49029eca3efbad0d74dbff3cb9129994ffab | https://bugzilla.suse.com/show_bug.cgi?id=1221035 |
| suse_bugzilla | https://git.kernel.org/stable/c/c79300599923daaa30f417c75555d5566b3d31ae | https://bugzilla.suse.com/show_bug.cgi?id=1221035 |
| suse_bugzilla | https://git.kernel.org/stable/c/fb5a4315591dae307a65fc246ca80b5159d296e1 | https://bugzilla.suse.com/show_bug.cgi?id=1221035 |
| suse_bugzilla | https://git.kernel.org/stable/c/fe2b811a02c3244ebf6059039e4a9e715e26a9e3 | https://bugzilla.suse.com/show_bug.cgi?id=1221035 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2267801 | https://bugzilla.suse.com/show_bug.cgi?id=1221035 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024030252-CVE-2023-52516-9b4a@gregkh/T/#u | https://bugzilla.redhat.com/show_bug.cgi?id=2267801 |
| ubuntu | https://git.kernel.org/linus/fb5a4315591dae307a65fc246ca80b5159d296e1 (6.6-rc1) | https://ubuntu.com/security/CVE-2023-52516 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2023-52516 | https://ubuntu.com/security/CVE-2023-52516 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2023-52516 | https://ubuntu.com/security/CVE-2023-52516 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2023-52516 | https://ubuntu.com/security/CVE-2023-52516 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2023-52516 | https://ubuntu.com/security/CVE-2023-52516 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-52516 |
| cve_search |  | https://git.kernel.org/stable/c/c79300599923daaa30f417c75555d5566b3d31ae |
| cve_search |  | https://git.kernel.org/stable/c/ac0d068099349cbca3d93f2e3b15bb329364b08c |
| cve_search |  | https://git.kernel.org/stable/c/be8f49029eca3efbad0d74dbff3cb9129994ffab |
| cve_search |  | https://git.kernel.org/stable/c/fe2b811a02c3244ebf6059039e4a9e715e26a9e3 |
| cve_search |  | https://git.kernel.org/stable/c/fb5a4315591dae307a65fc246ca80b5159d296e1 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52516 | https://ubuntu.com/security/CVE-2023-52516 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/fb5a4315591dae307a65fc246ca80b5159d296e1 | https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
        In the Linux kernel, the following vulnerability has been resolved:dma-debug: don t call __dma_entry_alloc_check_leak() under free_entries_lock__dma_entry_alloc_check_leak() calls into printk -> serial consoleoutput (qcom geni) and grabs port->lock under free_entries_lockspin lock, which is a reverse locking dependency chain as qcom_geniIRQ handler can call into dma-debug code and grab free_entries_lockunder port->lock.Move __dma_entry_alloc_check_leak() call out of free_entries_lockscope so that we don t acquire serial console s port->lock under it.Trimmed-down lockdep splat: The existing dependency chain (in reverse order) is:               -> #2 (free_entries_lock){-.-.}-{2:2}:        _raw_spin_lock_irqsave+0x60/0x80        dma_entry_alloc+0x38/0x110        debug_dma_map_page+0x60/0xf8        dma_map_page_attrs+0x1e0/0x230        dma_map_single_attrs.constprop.0+0x6c/0xc8        geni_se_rx_dma_prep+0x40/0xcc        qcom_geni_serial_isr+0x310/0x510        __handle_irq_event_percpu+0x110/0x244        handle_irq_event_percpu+0x20/0x54        handle_irq_event+0x50/0x88        handle_fasteoi_irq+0xa4/0xcc        handle_irq_desc+0x28/0x40        generic_handle_domain_irq+0x24/0x30        gic_handle_irq+0xc4/0x148        do_interrupt_handler+0xa4/0xb0        el1_interrupt+0x34/0x64        el1h_64_irq_handler+0x18/0x24        el1h_64_irq+0x64/0x68        arch_local_irq_enable+0x4/0x8        ____do_softirq+0x18/0x24        ...               -> #1 (&port_lock_key){-.-.}-{2:2}:        _raw_spin_lock_irqsave+0x60/0x80        qcom_geni_serial_console_write+0x184/0x1dc        console_flush_all+0x344/0x454        console_unlock+0x94/0xf0        vprintk_emit+0x238/0x24c        vprintk_default+0x3c/0x48        vprintk+0xb4/0xbc        _printk+0x68/0x90        register_console+0x230/0x38c        uart_add_one_port+0x338/0x494        qcom_geni_serial_probe+0x390/0x424        platform_probe+0x70/0xc0        really_probe+0x148/0x280        __driver_probe_device+0xfc/0x114        driver_probe_device+0x44/0x100        __device_attach_driver+0x64/0xdc        bus_for_each_drv+0xb0/0xd8        __device_attach+0xe4/0x140        device_initial_probe+0x1c/0x28        bus_probe_device+0x44/0xb0        device_add+0x538/0x668        of_device_add+0x44/0x50        of_platform_device_create_pdata+0x94/0xc8        of_platform_bus_create+0x270/0x304        of_platform_populate+0xac/0xc4        devm_of_platform_populate+0x60/0xac        geni_se_probe+0x154/0x160        platform_probe+0x70/0xc0        ...               -> #0 (console_owner){-...}-{0:0}:        __lock_acquire+0xdf8/0x109c        lock_acquire+0x234/0x284        console_flush_all+0x330/0x454        console_unlock+0x94/0xf0        vprintk_emit+0x238/0x24c        vprintk_default+0x3c/0x48        vprintk+0xb4/0xbc        _printk+0x68/0x90        dma_entry_alloc+0xb4/0x110        debug_dma_map_sg+0xdc/0x2f8        __dma_map_sg_attrs+0xac/0xe4        dma_map_sgtable+0x30/0x4c        get_pages+0x1d4/0x1e4 [msm]        msm_gem_pin_pages_locked+0x38/0xac [msm]        msm_gem_pin_vma_locked+0x58/0x88 [msm]        msm_ioctl_gem_submit+0xde4/0x13ac [msm]        drm_ioctl_kernel+0xe0/0x15c        drm_ioctl+0x2e8/0x3f4        vfs_ioctl+0x30/0x50        ... Chain exists of:   console_owner --> &port_lock_key --> free_entries_lock  Possible unsafe locking scenario:        CPU0                    CPU1        ----                    ----   lock(free_entries_lock);                                lock(&port_lock_key);                                lock(free_entries_lock);   lock(console_owner);                *** DEADLOCK *** Call trace:  dump_backtrace+0xb4/0xf0  show_stack+0x20/0x30  dump_stack_lvl+0x60/0x84  dump_stack+0x18/0x24  print_circular_bug+0x1cc/0x234  check_noncircular+0x78/0xac  __lock_acquire+0xdf8/0x109c  lock_acquire+0x234/0x284  console_flush_all+0x330/0x454  consol---truncated---   
 openEuler评分：
  5.5
 Vector：CVSS：2.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS(5.10.0):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):受影响
3.openEuler-22.03-LTS-SP2(5.10.0):受影响
4.openEuler-22.03-LTS-SP3(5.10.0):受影响
5.openEuler-20.03-LTS-SP1(4.19.90):不受影响
6.openEuler-20.03-LTS-SP4(4.19.90):不受影响
7.master(6.1.0):不受影响
8.openEuler-22.03-LTS-Next(5.10.0):不受影响
9.openEuler-24.03-LTS:不受影响
10.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(4.19.90):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS(5.10.0):否
4.openEuler-22.03-LTS-SP1(5.10.0):否
5.openEuler-22.03-LTS-SP2(5.10.0):否
6.openEuler-22.03-LTS-SP3(5.10.0):否
7.master(6.1.0):否
8.openEuler-22.03-LTS-Next(5.10.0):否
9.openEuler-24.03-LTS:否
10.openEuler-24.03-LTS-Next:否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-1487

src-openEuler/kernel
Closed

Content Risk Flag

Comments (11)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2023-52516

Comments (11)

Search

src-openEuler/kernel
Closed