CVE-2023-52982

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fscache: Use wait_on_bit() to wait for the freeing of relinquished volume

The freeing of relinquished volume will wake up the pending volume

acquisition by using wake_up_bit(), however it is mismatched with

wait_var_event() used in fscache_wait_on_volume_collision() and it will

never wake up the waiter in the wait-queue because these two functions

operate on different wait-queues.

According to the implementation in fscache_wait_on_volume_collision(),

if the wake-up of pending acquisition is delayed longer than 20 seconds

(e.g., due to the delay of on-demand fd closing), the first

wait_var_event_timeout() will timeout and the following wait_var_event()

will hang forever as shown below:

FS-Cache: Potential volume collision new=00000024 old=00000022

......

INFO: task mount:1148 blocked for more than 122 seconds.

Not tainted 6.1.0-rc6+ #1

task:mount state:D stack:0 pid:1148 ppid:1

Call Trace:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References