CVE-2023-52504

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52504
In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Disable KASAN in apply_alternatives() Fei has reported that KASAN triggers during apply_alternatives() on a 5-level paging machine: BUG: KASAN: out-of-bounds in rcu_is_watching() Read of size 4 at addr ff110003ee6419a0 by task swapper/0/0 ... __asan_load4() rcu_is_watching() trace_hardirqs_on() text_poke_early() apply_alternatives() ... On machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57) gets patched. It includes KASAN code, where KASAN_SHADOW_START depends on __VIRTUAL_MASK_SHIFT, which is defined with cpu_feature_enabled(). KASAN gets confused when apply_alternatives() patches the KASAN_SHADOW_START users. A test patch that makes KASAN_SHADOW_START static, by replacing __VIRTUAL_MASK_SHIFT with 56, works around the issue. Fix it for real by disabling KASAN while the kernel is patching alternatives. [ mingo: updated the changelog ]

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/3719d3c36aa853d5a2401af9f8d6b116c91ad5ae Patch
https://git.kernel.org/stable/c/3770c38cd6a60494da29ac2da73ff8156440a2d1 Patch
https://git.kernel.org/stable/c/5b784489c8158518bf7a466bb3cc045b0fb66b4b Patch
https://git.kernel.org/stable/c/6788b10620ca6e98575d1e06e72a8974aad7657e Patch
https://git.kernel.org/stable/c/cd287cc208dfe6bd6da98e7f88e723209242c9b4 Patch
https://git.kernel.org/stable/c/d35652a5fc9944784f6f50a5c979518ff8dacf61 Patch
https://git.kernel.org/stable/c/ecba5afe86f30605eb9dfb7f265a8de0218d4cfc Patch
https://git.kernel.org/stable/c/3719d3c36aa853d5a2401af9f8d6b116c91ad5ae Patch
https://git.kernel.org/stable/c/3770c38cd6a60494da29ac2da73ff8156440a2d1 Patch
https://git.kernel.org/stable/c/5b784489c8158518bf7a466bb3cc045b0fb66b4b Patch
https://git.kernel.org/stable/c/6788b10620ca6e98575d1e06e72a8974aad7657e Patch
https://git.kernel.org/stable/c/cd287cc208dfe6bd6da98e7f88e723209242c9b4 Patch
https://git.kernel.org/stable/c/d35652a5fc9944784f6f50a5c979518ff8dacf61 Patch
https://git.kernel.org/stable/c/ecba5afe86f30605eb9dfb7f265a8de0218d4cfc Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc5:*:*:*:*:*:*
History

11 Dec 2024, 15:05

Type Values Removed Values Added
CWE CWE-125
CPE cpe:2.3:o:linux:linux_kernel:6.6:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/3719d3c36aa853d5a2401af9f8d6b116c91ad5ae - () https://git.kernel.org/stable/c/3719d3c36aa853d5a2401af9f8d6b116c91ad5ae - Patch
References () https://git.kernel.org/stable/c/3770c38cd6a60494da29ac2da73ff8156440a2d1 - () https://git.kernel.org/stable/c/3770c38cd6a60494da29ac2da73ff8156440a2d1 - Patch
References () https://git.kernel.org/stable/c/5b784489c8158518bf7a466bb3cc045b0fb66b4b - () https://git.kernel.org/stable/c/5b784489c8158518bf7a466bb3cc045b0fb66b4b - Patch
References () https://git.kernel.org/stable/c/6788b10620ca6e98575d1e06e72a8974aad7657e - () https://git.kernel.org/stable/c/6788b10620ca6e98575d1e06e72a8974aad7657e - Patch
References () https://git.kernel.org/stable/c/cd287cc208dfe6bd6da98e7f88e723209242c9b4 - () https://git.kernel.org/stable/c/cd287cc208dfe6bd6da98e7f88e723209242c9b4 - Patch
References () https://git.kernel.org/stable/c/d35652a5fc9944784f6f50a5c979518ff8dacf61 - () https://git.kernel.org/stable/c/d35652a5fc9944784f6f50a5c979518ff8dacf61 - Patch
References () https://git.kernel.org/stable/c/ecba5afe86f30605eb9dfb7f265a8de0218d4cfc - () https://git.kernel.org/stable/c/ecba5afe86f30605eb9dfb7f265a8de0218d4cfc - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1

21 Nov 2024, 08:39

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: x86/alternatives: deshabilite KASAN en apply_alternatives() Fei ha informado que KASAN se activa durante apply_alternatives() en una máquina de paginación de 5 niveles: ERROR: KASAN: fuera de los límites en rcu_is_watching() Lectura de tamaño 4 en la dirección ff110003ee6419a0 mediante task swapper/0/0 ... __asan_load4() rcu_is_watching() trace_hardirqs_on() text_poke_early() apply_alternatives() ... En máquinas con paginación de 5 niveles, cpu_feature_enabled(X86_FEATURE_LA57) se parchea. Incluye código KASAN, donde KASAN_SHADOW_START depende de __VIRTUAL_MASK_SHIFT, que se define con cpu_feature_enabled(). KASAN se confunde cuando apply_alternatives() parchea a los usuarios de KASAN_SHADOW_START. Un parche de prueba que hace que KASAN_SHADOW_START sea estático, reemplazando __VIRTUAL_MASK_SHIFT con 56, soluciona el problema. Solucionelo de verdad deshabilitando KASAN mientras el kernel parchea alternativas. [mingo: actualizó el registro de cambios]
References () https://git.kernel.org/stable/c/3719d3c36aa853d5a2401af9f8d6b116c91ad5ae - () https://git.kernel.org/stable/c/3719d3c36aa853d5a2401af9f8d6b116c91ad5ae -
References () https://git.kernel.org/stable/c/3770c38cd6a60494da29ac2da73ff8156440a2d1 - () https://git.kernel.org/stable/c/3770c38cd6a60494da29ac2da73ff8156440a2d1 -
References () https://git.kernel.org/stable/c/5b784489c8158518bf7a466bb3cc045b0fb66b4b - () https://git.kernel.org/stable/c/5b784489c8158518bf7a466bb3cc045b0fb66b4b -
References () https://git.kernel.org/stable/c/6788b10620ca6e98575d1e06e72a8974aad7657e - () https://git.kernel.org/stable/c/6788b10620ca6e98575d1e06e72a8974aad7657e -
References () https://git.kernel.org/stable/c/cd287cc208dfe6bd6da98e7f88e723209242c9b4 - () https://git.kernel.org/stable/c/cd287cc208dfe6bd6da98e7f88e723209242c9b4 -
References () https://git.kernel.org/stable/c/d35652a5fc9944784f6f50a5c979518ff8dacf61 - () https://git.kernel.org/stable/c/d35652a5fc9944784f6f50a5c979518ff8dacf61 -
References () https://git.kernel.org/stable/c/ecba5afe86f30605eb9dfb7f265a8de0218d4cfc - () https://git.kernel.org/stable/c/ecba5afe86f30605eb9dfb7f265a8de0218d4cfc -

02 Mar 2024, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-02 22:15

Updated : 2024-12-11 15:05

NVD link : CVE-2023-52504

Mitre link : CVE-2023-52504

CVE.ORG link : CVE-2023-52504

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read