Bug 2426236 (CVE-2023-54324)

Summary:	CVE-2023-54324 kernel: dm: fix a race condition in retrieve_deps
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A use-after-free flaw was found in the Linux kernel's device-mapper multipath implementation. A race condition exists between retrieve_deps() and multipath_message() when devices are added or removed. The retrieve_deps() function walks the device list without holding a lock while multipath_message() can modify the list, leading to use-after-free or memory corruption.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-12-30 13:18:27 UTC

In the Linux kernel, the following vulnerability has been resolved:

dm: fix a race condition in retrieve_deps

There's a race condition in the multipath target when retrieve_deps
races with multipath_message calling dm_get_device and dm_put_device.
retrieve_deps walks the list of open devices without holding any lock
but multipath may add or remove devices to the list while it is
running. The end result may be memory corruption or use-after-free
memory access.

See this description of a UAF with multipath_message():
https://listman.redhat.com/archives/dm-devel/2022-October/052373.html

Fix this bug by introducing a new rw semaphore "devices_lock". We grab
devices_lock for read in retrieve_deps and we grab it for write in
dm_get_device and dm_put_device.

Comment 1 Alexander B 2025-12-30 23:11:17 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025123015-CVE-2023-54324-7149@gregkh/T