CVE-2023-52615

What it actually does

Deadlock in the hwrng read path triggered by recursive page fault when user reads from /dev/hwrng into memory that was also mmap-ed from the same device.

Why it matters to the business

Applications or services relying on hardware random number generation can cause the system to hang, leading to denial of service and operational disruption until reboot.

How an attack unfolds

An attacker with local access maps /dev/hwrng into memory and performs a read into that same mapped region; the resulting page fault initiates a recursive read that deadlocks the hwrng core.

How to fix it

Update the Linux kernel to a version containing commit eafd83b92f6c044007a3591cbd476bcf90455990 or later; apply the stack-buffer change for copy_to_user in the hwrng read path.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or test that reading from /dev/hwrng into an mmap-ed buffer no longer deadlocks.

Typical attack path

1. Obtain local access to the system
2. Open /dev/hwrng and mmap a region of memory from it
3. Issue a read from /dev/hwrng targeting the mmap-ed buffer
4. Trigger page fault that recurses into the hwrng read path
5. Deadlock occurs, freezing affected processes

How to detect it

Review system logs for hung task warnings or deadlocks involving hwrng; look for repeated access patterns to /dev/hwrng in process traces or audit logs.

What your security team should do

• Prioritize kernel updates on systems exposing /dev/hwrng to untrusted local users
• Monitor for kernel deadlocks or hung tasks involving hwrng
• Restrict local access to /dev/hwrng where feasible