Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - IB/ipoib修正 mcast 清單鎖定。在 `ipoib_mcast_join_task()` 中反覆 `priv->multicast_list` 時釋放 `priv->lock` 會開啟一個視窗讓 `ipoib_mcast_dev_flush()` 在過程中移除項目迭代。若在卸除鎖定的同時移除 mcast，for 迴圈會永遠旋轉，從而導致硬鎖定 (正如 RHEL 4.18.0-372.75.1.el8_6 kernel 核心中所報告的那樣)：工作 A (下方的 kworker/u72:2) | 工作 B (下方的 kworker/u72:0)
    -----------------------------------+----------------------------------- ipoib_mcast_join_task(work) | ipoib_ib_dev_flush_light(work) spin_lock_irq(&priv->lock) | __ipoib_ib_dev_flush(priv, ...) list_for_each_entry(mcast, | ipoib_mcast_dev_flush(dev = priv->dev) &priv->multicast_list, list) | ipoib_mcast_join(dev, mcast) | spin_unlock_irq(&priv->lock) | | spin_lock_irqsave(&priv->lock, flags) | list_for_each_entry_safe(mcast, tmcast, | &priv->multicast_list, list) | list_del(&mcast->list); | list_add_tail(&mcast->list, &remove_list) | spin_unlock_irqrestore(&priv->lock, flags) spin_lock_irq(&priv->lock) | | ipoib_mcast_remove_list(&remove_list) (Here, `mcast` is no longer on the | list_for_each_entry_safe(mcast, tmcast, `priv->multicast_list` and we keep | remove_list, list) spinning on the `remove_list` of | >>> wait_for_completion(&mcast->done) the other thread which is blocked | and the list is still valid on | it's stack.) 透過保持鎖定並變更為 GFP_ATOMIC 來修正此問題，以防最終進入睡眠狀態。遺憾的是，我們無法重現鎖定問題並確認此修正，但根據程式碼檢閱，我認為此修正應該可以解決此類鎖定問題。crash> bc 31 PID：747 TASK：ff1c6a1a007e8000 CPU：31 命令：kworker/u72:2 -- [異常 RIP：ipoib_mcast_join_task+0x1b1] RIP：ffffffffc0944ac1 RSP：ff646f199a8c7e00 RFLAGS：00000002 RAX：0000000000000000 RBX：ff1c6a1a04dc82f8 RCX：0000000000000000 work (&priv->mcast_task{,.work}) RDX：ff1c6a192d60ac68 RSI：0000000000000286 RDI：ff1c6a1a04dc8000 &mcast->list RBP：ff646f199a8c7e90 R8：ff1c699980019420 R9：ff1c6a1920c9a000 R10：ff646f199a8c7e00 R11：
    ff1c6a191a7d9800 R12：ff1c6a192d60ac00 mcast R13：ff1c6a1d82200000 R14：ff1c6a1a04dc8000 R15：
    ff1c6a1a04dc82d8 dev priv (&priv->lock) &priv->multicast_list (即 head) ORIG_RAX：ffffffffffffffff CS：
    0010 SS: 0018 --- <NMI exception stack> --- #5 [ff646f199a8c7e00] ffffffffc0944ac1 中的 ipoib_mcast_join_task+0x1b1 [ib_ipoib] #6 [ff646f199a8c7e98] ffffffff9bf10967 中的 process_one_work+0x1a7 crash> rx ff646f199a8c7e68 ff646f199a8c7e68: ff1c6a1a04dc82f8 <<< work = &priv->mcast_task.work crash> list -hO ipoib_dev_priv.multicast_list ff1c6a1a04dc8000 (empty) crash> ipoib_dev_priv.mcast_task.work.func,mcast_mutex.owner.counter ff1c6a1a04dc8000 mcast_task.work.func = 0xffffffffc0944910 <ipoib_mcast_join_task>, mcast_mutex.owner.counter = 0xff1c69998efec000 crash> b 8 PID：
    8 工作：ff1c69998efec000 CPU：33 命令：kworker/u72:0 -- #3 [ff646f1980153d50] ffffffff9c7d7646 中的 wait_for_completion+0x96 #4 [ff646f1980153d90] ffffffffc0944dc6 中的 ipoib_mcast_remove_list+0x56 [ib_ipoib] #5 [ff646f1980153de8] ffffffffc09455a7 中的 ipoib_mcast_dev_flush+0x1a7 [ib_ipoib] #6 [ff646f1980153e58] ffffffffc09431a4 中的 __ipoib_ib_dev_flush+0x1a4 [ib_ipoib] #7 [ff
    ---truncated--- (CVE-2023-52587)

請注意，Nessus 依賴供應商報告的套件存在。

偵測

Linux Distros 未修補的弱點：CVE-2023-52587

medium Nessus Plugin ID 226839

版本 1.20