Linux Kernel Vulnerability in QED Driver Allows Thread Blocking

CVE-2023-53509

What is CVE-2023-53509?

A vulnerability in the Linux kernel's QED driver causes excessive thread blocking due to improper command handling in the qed_mcp_cmd_and_union() function. This function can delay thread execution for over 5 seconds, resulting in severe thread scheduling delays, as evidenced by observed delays exceeding 700ms in production environments. The issue arises while executing qed_mcp_trace_dump(), which is called from ethtool. Adjustments in the code have been made to allow specific functions to sleep, alleviating the scheduling burdens and improving overall system performance.

References