CVE-2023-54107

What it actually does

Use-after-free in blk-cgroup where parent blkg refcount is dropped in __blkg_release before child pd_free_fn executes in the asynchronous blkg_free_work_fn, allowing child policies to dereference a freed parent pd structure.

Why it matters to the business

Kernel instability, crashes, or potential local privilege escalation on Linux systems using cgroups with block I/O policies, increasing downtime risk for servers and container workloads.

How an attack unfolds

An attacker triggers concurrent cgroup creation/deletion and blkcg policy deactivation to race parent pd_free_fn with child access, exploiting the refcount ordering flaw to read or write freed memory.

How to fix it

Upgrade the Linux kernel to a version containing commit c7241babf0855d8a6180cd1743ff0ec34de40b4e which delays parent refcount drop until after all child pd_free_fn calls complete.

How to confirm the fix worked

Confirm the patch is present by checking that __blkg_release no longer drops the parent refcount and that blkg_free_work_fn ordering guarantees pd_free_fn completion first.

Typical attack path

1. Create nested cgroups with blkio or io controllers enabled
2. Trigger rapid cgroup removal while holding references to parent pd
3. Invoke blkcg_deactivate_policy or device deletion to schedule blkg_free_work_fn
4. Access the parent pd through the child after the parent structure is freed

How to detect it

Inspect kernel logs and dmesg for use-after-free warnings, oops, or panic messages referencing blkg_free_work_fn, __blkg_release, or pd_free_fn; correlate with processes performing rapid cgroup blkio operations.

• blkg_free_work_fn
• __blkg_release
• pd_free_fn
• blk-cgroup UAF

What your security team should do

• Apply the referenced kernel commit or newer stable release immediately
• Restrict unprivileged users from creating or manipulating blk-cgroup hierarchies
• Enable kernel hardening features such as KASAN or page allocator freelist randomization for early detection