CVE-2023-53783

What it actually does

User-controlled max u64 value written to io.cost.model triggers integer overflow in calc_lcoefs() during DIV_ROUND_UP_ULL, resulting in divide-by-zero and kernel oops.

Why it matters to the business

Local denial-of-service on systems using io-cost cgroups can crash the kernel, interrupting workloads and requiring reboots; low prevalence reduces overall exposure.

How an attack unfolds

An attacker with permission to write to a cgroup's io.cost.model file supplies the maximum u64 value for rbps; the kernel's calc_lcoefs path performs an unchecked division that overflows and faults.

How to fix it

Upgrade affected kernels; for the listed webkit2gtk packages apply the supplied fixes (2.20.1-0ubuntu0.16.04.1 on 16.04 LTS and 2.20.0-2 on 18.04 LTS) and reboot.

How to confirm the fix worked

Confirm the patched kernel no longer accepts the max-u64 write without oops; verify /sys/fs/cgroup io.cost.model handling returns an error instead of crashing.

Typical attack path

1. Obtain write access to /sys/fs/cgroup/*/io.cost.model
2. Echo a device and rbps=18446744073709551615 into the file
3. Trigger ioc_cost_model_write -> ioc_refresh_params -> calc_lcoefs
4. Observe divide error and kernel panic

How to detect it

Search kernel logs for 'divide error' near calc_lcoefs and ioc_cost_model_write call traces; inspect audit logs for writes containing 18446744073709551615 to io.cost.model files.

• divide error: 0000 [#1] PREEMPT SMP
• RIP: 0010:calc_lcoefs+0x4c/0xc0
• ioc_cost_model_write
• echo .*18446744073709551615.*io.cost.model

What your security team should do

• Apply the listed fixed package versions immediately on Ubuntu 16.04/18.04 systems
• Restrict untrusted write access to cgroup io.cost.model files via permissions or SELinux
• Monitor for divide-error oops in kernel logs on any host exposing io-cost cgroups