CVE-2023-52504 x86/alternatives: Disable KASAN in apply_alternatives()
A KASAN out-of-bounds read in the Linux kernel x86 alternatives patching code can cause a kernel crash on 5-level paging systems.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-52504?
CVE-2023-52504 is a high-severity vulnerability in Linux kernel, published on 2 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
x86/alternatives: Disable KASAN in apply_alternatives()
Fei has reported that KASAN triggers during apply_alternatives() on a 5-level paging machine:
BUG: KASAN: out-of-bounds in rcu_is_watching() Read of size 4 at addr ff110003ee6419a0 by task swapper/0/0 ... __asan_load4() rcu_is_watching() trace_hardirqs_on() text_poke_early() apply_alternatives() ...
On machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57) gets patched. It includes KASAN code, where KASAN_SHADOW_START depends on __VIRTUAL_MASK_SHIFT, which is defined with cpu_feature_enabled().
KASAN gets confused when apply_alternatives() patches the KASAN_SHADOW_START users. A test patch that makes KASAN_SHADOW_START static, by replacing __VIRTUAL_MASK_SHIFT with 56, works around the issue.
Fix it for real by disabling KASAN while the kernel is patching alternatives.
[ mingo: updated the changelog ]
Weakness: CWE-125
Which versions are affected by CVE-2023-52504?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-52504?
Apply the vendor's patch.
Is CVE-2023-52504 being exploited?
There is no known exploitation of CVE-2023-52504 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-52504, DEBIAN-CVE-2023-52504, GHSA-59mx-6m8m-c99j, UBUNTU-CVE-2023-52504.