CVE-2023-52633 um: time-travel: fix time corruption
A race condition in Linux kernel time-travel mode can cause a crash when timer interrupts occur during time adjustment, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-52633?
CVE-2023-52633 is a medium-severity vulnerability in Linux kernel, published on 2 Apr 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
um: time-travel: fix time corruption
In 'basic' time-travel mode (without =inf-cpu or =ext), we still get timer interrupts. These can happen at arbitrary points in time, i.e. while in timer_read(), which pushes time forward just a little bit. Then, if we happen to get the interrupt after calculating the new time to push to, but before actually finishing that, the interrupt will set the time to a value that's incompatible with the forward, and we'll crash because time goes backwards when we do the forwarding.
Fix this by reading the time_travel_time, calculating the adjustment, and doing the adjustment all with interrupts disabled.
Weakness: CWE-787
Which versions are affected by CVE-2023-52633?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-52633?
Apply the vendor's patch.
Is CVE-2023-52633 being exploited?
There is no known exploitation of CVE-2023-52633 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2023-52633, DEBIAN-CVE-2023-52633, GHSA-c7h5-f667-cvc5, ROOT-OS-DEBIAN-11-CVE-2023-52633, UBUNTU-CVE-2023-52633.