CVE-2023-52615: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52615 is a vulnerability discovered in the Linux kernel's hardware random number generator (hwrng) component. The vulnerability was identified when users read from /dev/hwrng into memory that is also memory-mapped (mmap-ed) from /dev/hwrng, causing a deadlock condition in the device read path (Debian Security, Red Hat CVE).

The vulnerability occurs in the hwrng device read path when a user attempts to read from /dev/hwrng into memory that is also memory-mapped from the same device. The resulting page fault triggers a recursive read operation, which leads to a deadlock condition. The issue was traced back to the commit 9996508b3353 which introduced changes to the driver API for byte array handling (Kernel Git).

When exploited, this vulnerability results in a system deadlock condition when accessing the hardware random number generator, potentially affecting system stability and availability (NVD).

The vulnerability can be triggered when reading from /dev/hwrng into memory that is also mmap-ed from /dev/hwrng. This requires local access to the system and the ability to perform memory mapping operations on the hwrng device (Ubuntu Security).

The issue has been fixed by implementing a stack buffer when calling copy_to_user instead of directly copying from the mmap-ed memory. The fix was committed to the Linux kernel and is available in updated versions. System administrators should apply the latest kernel updates that include this fix (Kernel Git).