medium 5.5

CVE-2023-52587 json

IB/ipoib: Fix mcast list locking

published 2024-03-06 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-57211

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

Releasing the `priv->lock` while iterating the `priv->multicast_list` in `ipoib_mcast_join_task()` opens a window for `ipoib_mcast_dev_flush()` to remove the items while in the middle of iteration. If the mcast is removed while the lock was dropped, the for loop spins forever resulting in a hard lockup (as was reported on RHEL 4.18.0-372.75.1.el8_6 kernel):

Task A (kworker/u72:2 below) | Task B (kworker/u72:0 below) -----------------------------------+----------------------------------- ipoib_mcast_join_task(work) | ipoib_ib_dev_flush_light(work) spin_lock_irq(&priv->lock) | __ipoib_ib_dev_flush(priv, ...) list_for_each_entry(mcast, | ipoib_mcast_dev_flush(dev = priv->dev) &priv->multicast_list, list) | ipoib_mcast_join(dev, mcast) | spin_unlock_irq(&priv->lock) | | spin_lock_irqsave(&priv->lock, flags) | list_for_each_entry_safe(mcast, tmcast, | &priv->multicast_list, list) | list_del(&mcast->list); | list_add_tail(&mcast->list, &remove_list) | spin_unlock_irqrestore(&priv->lock, flags) spin_lock_irq(&priv->lock) | | ipoib_mcast_remove_list(&remove_list) (Here, `mcast` is no longer on the | list_for_each_entry_safe(mcast, tmcast, `priv->multicast_list` and we keep | remove_list, list) spinning on the `remove_list` of | >>> wait_for_completion(&mcast->done) the other thread which is blocked | and the list is still valid on | it's stack.)

Fix this by keeping the lock held and changing to GFP_ATOMIC to prevent eventual sleeps. Unfortunately we could not reproduce the lockup and confirm this fix but based on the code review I think this fix should address such lockups.

crash> bc 31 PID: 747 TASK: ff1c6a1a007e8000 CPU: 31 COMMAND: "kworker/u72:2" -- [exception RIP: ipoib_mcast_join_task+0x1b1] RIP: ffffffffc0944ac1 RSP: ff646f199a8c7e00 RFLAGS: 00000002 RAX: 0000000000000000 RBX: ff1c6a1a04dc82f8 RCX: 0000000000000000 work (&priv->mcast_task{,.work}) RDX: ff1c6a192d60ac68 RSI: 0000000000000286 RDI: ff1c6a1a04dc8000 &mcast->list RBP: ff646f199a8c7e90 R8: ff1c699980019420 R9: ff1c6a1920c9a000 R10: ff646f199a8c7e00 R11: ff1c6a191a7d9800 R12: ff1c6a192d60ac00 mcast R13: ff1c6a1d82200000 R14: ff1c6a1a04dc8000 R15: ff1c6a1a04dc82d8 dev priv (&priv->lock) &priv->multicast_list (aka head) ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 --- <NMI exception stack> --- #5 [ff646f199a8c7e00] ipoib_mcast_join_task+0x1b1 at ffffffffc0944ac1 [ib_ipoib] #6 [ff646f199a8c7e98] process_one_work+0x1a7 at ffffffff9bf10967

crash> rx ff646f199a8c7e68 ff646f199a8c7e68: ff1c6a1a04dc82f8 <<< work = &priv->mcast_task.work

crash> list -hO ipoib_dev_priv.multicast_list ff1c6a1a04dc8000 (empty)

crash> ipoib_dev_priv.mcast_task.work.func,mcast_mutex.owner.counter ff1c6a1a04dc8000 mcast_task.work.func = 0xffffffffc0944910 <ipoib_mcast_join_task>, mcast_mutex.owner.counter = 0xff1c69998efec000

crash> b 8 PID: 8 TASK: ff1c69998efec000 CPU: 33 COMMAND: "kworker/u72:0" -- #3 [ff646f1980153d50] wait_for_completion+0x96 at ffffffff9c7d7646 #4 [ff646f1980153d90] ipoib_mcast_remove_list+0x56 at ffffffffc0944dc6 [ib_ipoib] #5 [ff646f1980153de8] ipoib_mcast_dev_flush+0x1a7 at ffffffffc09455a7 [ib_ipoib] #6 [ff646f1980153e58] __ipoib_ib_dev_flush+0x1a4 at ffffffffc09431a4 [ib_ipoib] #7 [ff ---truncated---

Patch / fix

fixed in 1 distros 3 links 10

Linux Linux 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, 6.8

debian ubuntu suse

linux Debian 12 6.1.82-1
linux Debian 14, Debian 13 6.7.7-1

debian advisories DEBIAN-CVE-2023-52587

linux Ubuntu 20.04 LTS 5.4.0-181.201
linux Ubuntu 22.04 LTS 5.15.0-106.116
linux-aws Ubuntu 20.04 LTS 5.4.0-1124.134
linux-aws Ubuntu 22.04 LTS 5.15.0-1061.67
linux-gcp Ubuntu 20.04 LTS 5.4.0-1128.137
linux-gcp Ubuntu 22.04 LTS 5.15.0-1059.67
linux-gke Ubuntu 22.04 LTS 5.15.0-1058.63
linux-ibm Ubuntu 20.04 LTS 5.4.0-1071.76

ubuntu advisories UBUNTU-CVE-2023-52587

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-syms SLES for SAP 12 SP5, SLES 12 SP5 4.12.14-122.216.1
kernel-source SLES for SAP 12 SP5, SLES 12 SP5 4.12.14-122.216.1
kernel-default SLES for SAP 12 SP5, SLES 12 SP5, SLE Workstation Extension 12 SP5 +2 more 4.12.14-122.216.1
kernel-obs-build SLE Software Development Kit 12 SP5 4.12.14-122.216.1
kernel-rt SLE Real Time 12 SP5 4.12.14-10.182.1
kernel-syms-rt SLE Real Time 12 SP5 4.12.14-10.182.1
kernel-rt_debug SLE Real Time 12 SP5 4.12.14-10.182.1
kernel-source-rt SLE Real Time 12 SP5 4.12.14-10.182.1

suse advisories SUSE-SU-2024:1870-1 SUSE-SU-2024:1646-1 SUSE-SU-2024:1643-1 SUSE-SU-2024:1490-1 SUSE-SU-2024:1480-1 SUSE-SU-2024:1466-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-25-226-15 updated 2026-02-25

Siemens SINEC OS

Siemens RUGGEDCOM RST2428P (6GK6242-6PA00) Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family
not affected

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

red hat product security vex CVE-2023-52587 updated 2025-11-21 cvss 5.5

kernel: IB/ipoib: Fix mcast list locking

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +82 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-03-08)

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

git.kernel.org https://git.kernel.org/stable/c/4c8922ae8eb8dcc1e4b7d1059d97a8334288d825 referenced PoC, tagged "exploit" by a source, unverified
git.kernel.org https://git.kernel.org/stable/c/615e3adc2042b7be4ad122a043fc9135e6342c90 referenced PoC, tagged "exploit" by a source, unverified
git.kernel.org https://git.kernel.org/stable/c/ac2630fd3c90ffec34a0bfc4d413668538b0e8f2 referenced PoC, tagged "exploit" by a source, unverified
git.kernel.org https://git.kernel.org/stable/c/ed790bd0903ed3352ebf7f650d910f49b7319b34 referenced PoC, tagged "exploit" by a source, unverified
git.kernel.org https://git.kernel.org/stable/c/5108a2dc2db5630fb6cd58b8be80a0c134bc310a referenced PoC, tagged "exploit" by a source, unverified
git.kernel.org https://git.kernel.org/stable/c/342258fb46d66c1b4c7e2c3717ac01e10c03cf18 referenced PoC, tagged "exploit" by a source, unverified
git.kernel.org https://git.kernel.org/stable/c/7c7bd4d561e9dc6f5b7df9e184974915f6701a89 referenced PoC, tagged "exploit" by a source, unverified
git.kernel.org https://git.kernel.org/stable/c/4f973e211b3b1c6d36f7c6a19239d258856749f9 referenced PoC, tagged "exploit" by a source, unverified
lists.debian.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html referenced PoC, tagged "exploit" by a source, unverified
lists.debian.org https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Linux Linux

Classification

Weakness

CWE-667 Improper Locking

Technology feeds

Linux kernel rss critical rss

References

git.kernel.org /stable/c/4c8922ae8eb8dcc1e4b7d1059d97a8334288d825
exploit, mailing-list, patch
git.kernel.org /stable/c/615e3adc2042b7be4ad122a043fc9135e6342c90
exploit, mailing-list, patch
git.kernel.org /stable/c/ac2630fd3c90ffec34a0bfc4d413668538b0e8f2
exploit, mailing-list, patch
git.kernel.org /stable/c/ed790bd0903ed3352ebf7f650d910f49b7319b34
exploit, mailing-list, patch
git.kernel.org /stable/c/5108a2dc2db5630fb6cd58b8be80a0c134bc310a
exploit, mailing-list, patch
git.kernel.org /stable/c/342258fb46d66c1b4c7e2c3717ac01e10c03cf18
exploit, mailing-list, patch
git.kernel.org /stable/c/7c7bd4d561e9dc6f5b7df9e184974915f6701a89
exploit, mailing-list, patch
git.kernel.org /stable/c/4f973e211b3b1c6d36f7c6a19239d258856749f9
exploit, mailing-list, patch
lists.debian.org /debian-lts-announce/2024/06/msg00017.html
exploit, mailing-list, patch
lists.debian.org /debian-lts-announce/2024/06/msg00020.html
exploit, mailing-list, patch

Sources

CVE List CVE-2023-52587
NVD CVE-2023-52587

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary