CVE-2023-53760
BaseFortify
Publication date: 2025-12-08
Last updated on: 2025-12-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.1.17 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a deadlock issue in the Linux kernel's UFS (Universal Flash Storage) subsystem. Specifically, when the ufshcd_err_handler() function is executed, an interrupt related to the completion queue (CQ) event can attempt to acquire the same lock (&hwq->cq_lock) that is already held, causing a deadlock. The problem arises because the lock is used improperly in IRQ context with IRQs enabled, leading to inconsistent lock states and a potential system hang. The fix involves using a polling lock function (ufshcd_mcq_poll_cqe_lock) with spin_lock_irqsave instead of spin_lock to avoid this deadlock.
How can this vulnerability impact me? :
This vulnerability can cause a deadlock in the Linux kernel's UFS driver, potentially leading to system hangs or freezes when the affected lock is contended during interrupt handling. This can degrade system stability and reliability, possibly requiring a reboot to recover from the deadlock state.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the kernel logs for specific warning messages related to lockdep inconsistent lock states and deadlocks involving &hwq->cq_lock. You can use the command 'dmesg | grep -i lockdep' or 'journalctl -k | grep -i lockdep' to look for warnings such as 'WARNING: inconsistent lock state' and messages indicating deadlocks in ufshcd_mcq_poll_cqe_lock or ufshcd_err_handler. These messages indicate the presence of the deadlock issue described.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this deadlock issue in the UFS host controller driver (ufshcd) has been fixed. The fix involves using ufshcd_mcq_poll_cqe_lock() with spin_lock_irqsave instead of spin_lock to avoid the deadlock. Until an update is applied, monitoring for the warning messages and avoiding workloads that trigger the ufshcd_err_handler may reduce the risk of deadlocks.