CVE-2023-52672

pipe: wakeup wr_wait after setting max_usage

State: Published
Severity: 7.0 High
Published: May 17, 2024
Updated: May 11, 2026
Reserved: Mar 7, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

pipe: wakeup wr_wait after setting max_usage

Commit c73be61cede5 ("pipe: Add general notification queue support") a regression was introduced that would lock up resized pipes under certain conditions. See the reproducer in [1].

The commit resizing the pipe ring size was moved to a different function, doing that moved the wakeup for pipe->wr_wait before actually raising pipe->max_usage. If a pipe was full before the resize occured it would result in the wakeup never actually triggering pipe_write.

Set @max_usage and @nr_accounted before waking writers if this isn't a watch queue.

[Christian Brauner <brauner@kernel.org>: rewrite to account for watch queues]

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
LinuxLinux	c73be61cede5882f9605a852414db559c0ebedfd to before 162ae0e78bdabf84ef10c1293c4ed7865cb7d3c8Affected c73be61cede5882f9605a852414db559c0ebedfd to before 3efbd114b91525bb095b8ae046382197d92126b9Affected c73be61cede5882f9605a852414db559c0ebedfd to before b87a1229d8668fbc78ebd9ca0fc797a76001c60fAffected c73be61cede5882f9605a852414db559c0ebedfd to before 68e51bdb1194f11d3452525b99c98aff6f837b24Affected c73be61cede5882f9605a852414db559c0ebedfd to before 6fb70694f8d1ac34e45246b0ac988f025e1e5b55Affected c73be61cede5882f9605a852414db559c0ebedfd to before e95aada4cb93d42e25c30a0ef9eb2923d9711d4aAffected
LinuxLinux	5.8Affected before 5.8Not affected 5.10.210 through 5.10.Not affected 5.15.149 through 5.15.Not affected 6.1.76 through 6.1.Not affected 6.6.15 through 6.6.Not affected 6.7.3 through 6.7.*Not affected 6.8 and laterNot affected

Product

Versions

LinuxLinux

c73be61cede5882f9605a852414db559c0ebedfd to before 162ae0e78bdabf84ef10c1293c4ed7865cb7d3c8Affected
c73be61cede5882f9605a852414db559c0ebedfd to before 3efbd114b91525bb095b8ae046382197d92126b9Affected
c73be61cede5882f9605a852414db559c0ebedfd to before b87a1229d8668fbc78ebd9ca0fc797a76001c60fAffected
c73be61cede5882f9605a852414db559c0ebedfd to before 68e51bdb1194f11d3452525b99c98aff6f837b24Affected
c73be61cede5882f9605a852414db559c0ebedfd to before 6fb70694f8d1ac34e45246b0ac988f025e1e5b55Affected
c73be61cede5882f9605a852414db559c0ebedfd to before e95aada4cb93d42e25c30a0ef9eb2923d9711d4aAffected

LinuxLinux

5.8Affected
before 5.8Not affected
5.10.210 through 5.10.*Not affected
5.15.149 through 5.15.*Not affected
6.1.76 through 6.1.*Not affected
6.6.15 through 6.6.*Not affected
6.7.3 through 6.7.*Not affected
6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.