CVE-2023-52562

What it actually does

Improper handling of shutdown_cache() return value in kmem_cache_destroy() allows a kmem_cache object to be released without removal from the slab_caches list when allocated objects remain, resulting in list corruption.

Why it matters to the business

Kernel modules or workloads that leak slab objects can trigger immediate system instability or crashes on list operations or slabinfo access, forcing reboots and reducing availability of Linux-based systems.

How an attack unfolds

An attacker or faulty module creates a slab cache, leaks objects, then calls rmmod; the subsequent list corruption is triggered on next kmem_cache create/destroy or slabinfo read, causing kernel BUG or general protection fault.

How to fix it

Upgrade the Linux kernel to the commit a5569bb187521432f509b69dda7d29f78b2d38b0 or later stable releases that correctly check the shutdown_cache() return value before releasing the kmem_cache object.

How to confirm the fix worked

Verify the running kernel contains commit a5569bb187521432f509b69dda7d29f78b2d38b0; reproduce the original leak scenario under CONFIG_DEBUG_LIST=y and confirm absence of list corruption assertions.

Typical attack path

1. Load a kernel module that allocates objects from a custom slab cache
2. Cause the module to leak at least one object without freeing it
3. Unload the module via rmmod, invoking kmem_cache_destroy()
4. Trigger any subsequent slab cache creation, destruction, or /proc/slabinfo access
5. Observe list_del corruption or non-canonical address fault leading to panic

How to detect it

Search kernel logs for 'list_del corruption', 'kernel BUG at lib/list_debug.c', 'general protection fault' with non-canonical addresses, or panics involving get_slabinfo and rmmod processes.

• list_del corruption. next->prev should be
• kernel BUG at lib/list_debug.c:62
• general protection fault, probably for non-canonical address
• get_slabinfo+0x42/0xf0
• __list_del_entry_valid+0xae/0xb0
• Tainted: G B W OE

What your security team should do

• Apply the referenced kernel patch or upgrade to a fixed distribution kernel immediately
• Audit custom kernel modules for proper object release before cache destruction
• Enable CONFIG_DEBUG_LIST and monitor for list corruption messages in production kernels
• Restrict unprivileged module loading where feasible until systems are updated