cve-2023-52659
Vulnerability from cvelistv5
Published
2024-05-17 12:08
Modified
2024-08-02 23:03
Severity
Summary
x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/325956b0173f11e98f90462be4829a8b8b0682ce
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7e1471888a5e6e846e9b4d306e5327db2b58e64e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/814305b5c23cb815ada68d43019f39050472b25f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8e5647a723c49d73b9f108a8bb38e8c29d3948ea
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52659",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T15:56:17.694229Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:23:47.671Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:21.334Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/325956b0173f11e98f90462be4829a8b8b0682ce"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7e1471888a5e6e846e9b4d306e5327db2b58e64e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/814305b5c23cb815ada68d43019f39050472b25f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8e5647a723c49d73b9f108a8bb38e8c29d3948ea"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/include/asm/page.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "325956b0173f",
              "status": "affected",
              "version": "6c3211796326",
              "versionType": "git"
            },
            {
              "lessThan": "7e1471888a5e",
              "status": "affected",
              "version": "6c3211796326",
              "versionType": "git"
            },
            {
              "lessThan": "814305b5c23c",
              "status": "affected",
              "version": "6c3211796326",
              "versionType": "git"
            },
            {
              "lessThan": "8e5647a723c4",
              "status": "affected",
              "version": "6c3211796326",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/include/asm/page.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type\n\nOn 64-bit platforms, the pfn_to_kaddr() macro requires that the input\nvalue is 64 bits in order to ensure that valid address bits don\u0027t get\nlost when shifting that input by PAGE_SHIFT to calculate the physical\naddress to provide a virtual address for.\n\nOne such example is in pvalidate_pages() (used by SEV-SNP guests), where\nthe GFN in the struct used for page-state change requests is a 40-bit\nbit-field, so attempts to pass this GFN field directly into\npfn_to_kaddr() ends up causing guest crashes when dealing with addresses\nabove the 1TB range due to the above.\n\nFix this issue with SEV-SNP guests, as well as any similar cases that\nmight cause issues in current/future code, by using an inline function,\ninstead of a macro, so that the input is implicitly cast to the\nexpected 64-bit input type prior to performing the shift operation.\n\nWhile it might be argued that the issue is on the caller side, other\narchs/macros have taken similar approaches to deal with instances like\nthis, such as ARM explicitly casting the input to phys_addr_t:\n\n  e48866647b48 (\"ARM: 8396/1: use phys_addr_t in pfn_to_kaddr()\")\n\nA C inline function is even better though.\n\n[ mingo: Refined the changelog some more \u0026 added __always_inline. ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:15:26.187Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/325956b0173f11e98f90462be4829a8b8b0682ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e1471888a5e6e846e9b4d306e5327db2b58e64e"
        },
        {
          "url": "https://git.kernel.org/stable/c/814305b5c23cb815ada68d43019f39050472b25f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e5647a723c49d73b9f108a8bb38e8c29d3948ea"
        }
      ],
      "title": "x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52659",
    "datePublished": "2024-05-17T12:08:36.098Z",
    "dateReserved": "2024-03-07T14:49:46.884Z",
    "dateUpdated": "2024-08-02T23:03:21.334Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52659\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T13:15:57.677\",\"lastModified\":\"2024-05-17T18:35:35.070\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type\\n\\nOn 64-bit platforms, the pfn_to_kaddr() macro requires that the input\\nvalue is 64 bits in order to ensure that valid address bits don\u0027t get\\nlost when shifting that input by PAGE_SHIFT to calculate the physical\\naddress to provide a virtual address for.\\n\\nOne such example is in pvalidate_pages() (used by SEV-SNP guests), where\\nthe GFN in the struct used for page-state change requests is a 40-bit\\nbit-field, so attempts to pass this GFN field directly into\\npfn_to_kaddr() ends up causing guest crashes when dealing with addresses\\nabove the 1TB range due to the above.\\n\\nFix this issue with SEV-SNP guests, as well as any similar cases that\\nmight cause issues in current/future code, by using an inline function,\\ninstead of a macro, so that the input is implicitly cast to the\\nexpected 64-bit input type prior to performing the shift operation.\\n\\nWhile it might be argued that the issue is on the caller side, other\\narchs/macros have taken similar approaches to deal with instances like\\nthis, such as ARM explicitly casting the input to phys_addr_t:\\n\\n  e48866647b48 (\\\"ARM: 8396/1: use phys_addr_t in pfn_to_kaddr()\\\")\\n\\nA C inline function is even better though.\\n\\n[ mingo: Refined the changelog some more \u0026 added __always_inline. ]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/mm: garantiza que la entrada a pfn_to_kaddr() se trate como un tipo de 64 bits. En plataformas de 64 bits, la macro pfn_to_kaddr() requiere que el valor de entrada sea de 64 bits en para garantizar que los bits de direcci\u00f3n v\u00e1lidos no se pierdan al cambiar esa entrada mediante PAGE_SHIFT para calcular la direcci\u00f3n f\u00edsica para la que proporcionar una direcci\u00f3n virtual. Un ejemplo de ello es pvalidate_pages() (utilizado por invitados SEV-SNP), donde el GFN en la estructura utilizada para las solicitudes de cambio de estado de p\u00e1gina es un campo de bits de 40 bits, por lo que se intenta pasar este campo GFN directamente a pfn_to_kaddr( ) termina causando fallas en los invitados cuando se trata de direcciones por encima del rango de 1 TB debido a lo anterior. Solucione este problema con los invitados SEV-SNP, as\u00ed como cualquier caso similar que pueda causar problemas en el c\u00f3digo actual/futuro, utilizando una funci\u00f3n en l\u00ednea, en lugar de una macro, de modo que la entrada se convierta impl\u00edcitamente a la entrada esperada de 64 bits. tipo antes de realizar la operaci\u00f3n de cambio. Si bien se podr\u00eda argumentar que el problema est\u00e1 en el lado de la persona que llama, otros arcos/macros han adoptado enfoques similares para lidiar con casos como este, como ARM que env\u00eda expl\u00edcitamente la entrada a phys_addr_t: e48866647b48 (\\\"ARM: 8396/1: use phys_addr_t in pfn_to_kaddr()\\\") La funci\u00f3n en l\u00ednea AC es a\u00fan mejor. [mingo: refin\u00f3 un poco m\u00e1s el registro de cambios y agreg\u00f3 __always_inline. ]\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/325956b0173f11e98f90462be4829a8b8b0682ce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7e1471888a5e6e846e9b4d306e5327db2b58e64e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/814305b5c23cb815ada68d43019f39050472b25f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8e5647a723c49d73b9f108a8bb38e8c29d3948ea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.