CVE-2023-53998

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the virtio random number generator (rng) device when handling entropy requests and data availability. Specifically, the issue occurs when a new request is initiated at the end of a read operation, leading to a potential race between the writing of new data and the next reader due to a lack of synchronization. This can occur because the data avail variable is not properly synchronized between the writer and the reader. The fix involves using smp store release when writing data avail and smp load acquire when reading it during the initial read operation. Redundant zeroing of data idx and data avail has also been removed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.