CVE-2023-54267
Last modified
CVE-2023-54267 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT lppaca_shared_proc() takes a pointer to the lppaca which is typically accessed through get_lppaca(). With DEBUG_PREEMPT enabled, this leads to checking if preemption is enabled, for example: BUG: using smp_processor_id() in preemptible [00000000] code: grep/10693 caller is lparcfg_data+0x408/0x19a0 CPU: 4 PID: 10693 Comm: grep Not tainted 6.5.0-rc3 #2 Call Trace: dump_stack_lvl+0x154/0x200 (unreliable) check_preemption_disabled+0x214/0x220 lparcfg_data+0x408/0x19a0 ... This isn't actually a problem however, as it does not matter which lppaca is accessed, the shared proc state will be the same. vcpudispatch_stats_procfs_init() already works around this by disabling preemption, but the lparcfg code does not, erroring any time /proc/powerpc/lparcfg is accessed with DEBUG_PREEMPT enabled. Instead of disabling preemption on the caller side, rework lppaca_shared_proc() to not take a pointer and instead directly access the lppaca, bypassing any potential preemption checks. [mpe: Rework to avoid needing a definition in paca.h and lppaca.h]. EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT lppaca_shared_proc() takes a pointer to the lppaca which is typically accessed through get_lppaca(). With DEBUG_PREEMPT enabled, this leads to checking if preemption is enabled, for example: BUG: using smp_processor_id() in preemptible [00000000] code: grep/10693 caller is lparcfg_data+0x408/0x19a0 CPU: 4 PID: 10693 Comm: grep Not tainted 6.5.0-rc3 #2 Call Trace: dump_stack_lvl+0x154/0x200 (unreliable) check_preemption_disabled+0x214/0x220 lparcfg_data+0x408/0x19a0 ... This isn't actually a problem however, as it does not matter which lppaca is accessed, the shared proc state will be the same. vcpudispatch_stats_procfs_init() already works around this by disabling preemption, but the lparcfg code does not, erroring any time /proc/powerpc/lparcfg is accessed with DEBUG_PREEMPT enabled. Instead of disabling preemption on the caller side, rework lppaca_shared_proc() to not take a pointer and instead directly access the lppaca, bypassing any potential preemption checks. [mpe: Rework to avoid needing a definition in paca.h and lppaca.h]
Metrics
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= f13c13a005127b5dc5daaca190277a062d946e63, < 953c54dfdc5d3eb7243ed902b50acb5ea1db4355; >= f13c13a005127b5dc5daaca190277a062d946e63, < 2935443dc9c28499223d8c881474259e4b998f2a; >= f13c13a005127b5dc5daaca190277a062d946e63, < 4c8568cf4c45b415854195c8832b557cdefba57a; >= f13c13a005127b5dc5daaca190277a062d946e63, < 3c5e8e666794d7dde6d14ea846c6c04f2bb34900; >= f13c13a005127b5dc5daaca190277a062d946e63, < f45ee5c074013a0fbfce77a5af5efddb01f5d4f4; >= f13c13a005127b5dc5daaca190277a062d946e63, < eac030b22ea12cdfcbb2e941c21c03964403c63f |
| Linux | Linux | 3.12 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2023-54267?
How severe is CVE-2023-54267?
How do I fix CVE-2023-54267?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-54261In the Linux kernel, the following vulnerability has been re…
- CVE-2023-54262In the Linux kernel, the following vulnerability has been re…8.8
- CVE-2023-54263In the Linux kernel, the following vulnerability has been re…
- CVE-2023-54264In the Linux kernel, the following vulnerability has been re…
- CVE-2023-54265In the Linux kernel, the following vulnerability has been re…
- CVE-2023-54266In the Linux kernel, the following vulnerability has been re…
- CVE-2023-54268In the Linux kernel, the following vulnerability has been re…
- CVE-2023-54269In the Linux kernel, the following vulnerability has been re…9.8
- CVE-2023-5427Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel D…7.8
- CVE-2023-54270In the Linux kernel, the following vulnerability has been re…
- CVE-2023-54271In the Linux kernel, the following vulnerability has been re…
- CVE-2023-54272In the Linux kernel, the following vulnerability has been re…
Are you affected by CVE-2023-54267?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST
