CVE-2023-52707

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: sched/psi: Fix use-after-free in ep_remove_wait_queue() If a non-root cgroup gets removed when there is a thread that registered trigger and is polling on a pressure file within the cgroup, the polling waitqueue gets freed in the following path: do_rmdir cgroup_rmdir kernfs_drain_open_files cgroup_file_release cgroup_pressure_release psi_trigger_destroy However, the polling thread still has a reference to the pressure file and will access the freed waitqueue when the file is closed or upon exit: fput ep_eventpoll_release ep...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 0e94682b73bfa6c44c98af7a26771c9c08c055d5 < 7caeb5457bd01ccba0df1d6f4872f20d28e50b38, >= 0e94682b73bfa6c44c98af7a26771c9c08c055d5 < ec9c7aa08819f976b2492fa63c41b5712d2924b5, >= 0e94682b73bfa6c44c98af7a26771c9c08c055d5 < cca2b3feb70170ef6f0fbc4b4d91eea235a2b73a, >= 0e94682b73bfa6c44c98af7a26771c9c08c055d5 < c6879a4dcefe92d870ab68cabaa9caeda4f2af5a, >= 0e94682b73bfa6c44c98af7a26771c9c08c055d5 < c2dbe32d5db5c4ead121cf86dabd5ab691fb47fe, >= 5.2, >= 5.2 < 5.4.232, >= 5.5 < 5.10.169, >= 5.11 < 5.15.95, >= 5.16 < 6.1.13, 6.2

Fixed versions

5.4.232, 5.10.169, 5.15.95, 6.1.13

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416