CVE-2023-53694
Last modified
CVE-2023-53694 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: riscv: ftrace: Fixup panic by disabling preemption In RISCV, we must use an AUIPC + JALR pair to encode an immediate, forming a jump that jumps to an address over 4K. This may cause errors if we want to enable kernel preemption and remove dependency from patching code with stop_machine(). EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
In the Linux kernel, the following vulnerability has been resolved: riscv: ftrace: Fixup panic by disabling preemption In RISCV, we must use an AUIPC + JALR pair to encode an immediate, forming a jump that jumps to an address over 4K. This may cause errors if we want to enable kernel preemption and remove dependency from patching code with stop_machine(). For example, if a task was switched out on auipc. And, if we changed the ftrace function before it was switched back, then it would jump to an address that has updated 11:0 bits mixing with previous XLEN:12 part. p: patched area performed by dynamic ftrace ftrace_prologue: p| REG_S ra, -SZREG(sp) p| auipc ra, 0x? ------------> preempted ... change ftrace function ... p| jalr -?(ra) <------------- switched back p| REG_L ra, -SZREG(sp) func: xxx ret
Metrics
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= afc76b8b80112189b6f11e67e19cf58301944814, < 84cfcf240f4a577733b1d98fcd2611a611612b03; >= afc76b8b80112189b6f11e67e19cf58301944814, < 20a7510e781084364691b4962de31de758194cc9; >= afc76b8b80112189b6f11e67e19cf58301944814, < 8547649981e6631328cd64f583667501ae385531 |
| Linux | Linux | 5.12 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2023-53694?
How severe is CVE-2023-53694?
How do I fix CVE-2023-53694?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-53689Nagios Fusion versions prior to 4.2.0 contain a reflected cr…4.8
- CVE-2023-5369Before correction, the copy_file_range system call checked o…7.1
- CVE-2023-53690Nagios Fusion versions prior to 4.2.0 contain a stored cross…4.8
- CVE-2023-53691Hikvision CSMP (Comprehensive Security Management Platform) …8.3
- CVE-2023-53692In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2023-53693In the Linux kernel, the following vulnerability has been re…
- CVE-2023-53695In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2023-53696In the Linux kernel, the following vulnerability has been re…
- CVE-2023-53697In the Linux kernel, the following vulnerability has been re…
- CVE-2023-53698In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2023-53699In the Linux kernel, the following vulnerability has been re…
- CVE-2023-5370On CPU 0 the check for the SMCCC workaround is called before…5.5
Are you affected by CVE-2023-53694?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST