cve-2023-52740
Vulnerability from cvelistv5
Published
2024-05-21 15:23
Modified
2024-08-02 23:11
Severity
Summary
powerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2ea31e2e62bbc4d11c411eeb36f1b02841dbcab1
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6f097c24815e67909a1fcc2c605586d02babd673
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/86f7e423933608d536015a0f2eb9e0338c1227e0
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52740",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T18:15:22.000735Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:23:49.892Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:35.916Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/86f7e423933608d536015a0f2eb9e0338c1227e0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6f097c24815e67909a1fcc2c605586d02babd673"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2ea31e2e62bbc4d11c411eeb36f1b02841dbcab1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/kernel/interrupt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "86f7e4239336",
              "status": "affected",
              "version": "13799748b957",
              "versionType": "git"
            },
            {
              "lessThan": "6f097c24815e",
              "status": "affected",
              "version": "13799748b957",
              "versionType": "git"
            },
            {
              "lessThan": "2ea31e2e62bb",
              "status": "affected",
              "version": "13799748b957",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/kernel/interrupt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.94",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.12",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch\n\nThe RFI and STF security mitigation options can flip the\ninterrupt_exit_not_reentrant static branch condition concurrently with\nthe interrupt exit code which tests that branch.\n\nInterrupt exit tests this condition to set MSR[EE|RI] for exit, then\nagain in the case a soft-masked interrupt is found pending, to recover\nthe MSR so the interrupt can be replayed before attempting to exit\nagain. If the condition changes between these two tests, the MSR and irq\nsoft-mask state will become corrupted, leading to warnings and possible\ncrashes. For example, if the branch is initially true then false,\nMSR[EE] will be 0 but PACA_IRQ_HARD_DIS clear and EE may not get\nenabled, leading to warnings in irq_64.c."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:16:27.636Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/86f7e423933608d536015a0f2eb9e0338c1227e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f097c24815e67909a1fcc2c605586d02babd673"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ea31e2e62bbc4d11c411eeb36f1b02841dbcab1"
        }
      ],
      "title": "powerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52740",
    "datePublished": "2024-05-21T15:23:03.201Z",
    "dateReserved": "2024-05-21T15:19:24.233Z",
    "dateUpdated": "2024-08-02T23:11:35.916Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52740\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T16:15:13.900\",\"lastModified\":\"2024-05-21T16:53:56.550\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch\\n\\nThe RFI and STF security mitigation options can flip the\\ninterrupt_exit_not_reentrant static branch condition concurrently with\\nthe interrupt exit code which tests that branch.\\n\\nInterrupt exit tests this condition to set MSR[EE|RI] for exit, then\\nagain in the case a soft-masked interrupt is found pending, to recover\\nthe MSR so the interrupt can be replayed before attempting to exit\\nagain. If the condition changes between these two tests, the MSR and irq\\nsoft-mask state will become corrupted, leading to warnings and possible\\ncrashes. For example, if the branch is initially true then false,\\nMSR[EE] will be 0 but PACA_IRQ_HARD_DIS clear and EE may not get\\nenabled, leading to warnings in irq_64.c.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: powerpc/64s/interrupt: corrige la ejecuci\u00f3n de salida de interrupci\u00f3n con un interruptor de mitigaci\u00f3n de seguridad. Las opciones de mitigaci\u00f3n de seguridad RFI y STF pueden invertir la condici\u00f3n de rama est\u00e1tica interrupt_exit_not_reentrant al mismo tiempo que el c\u00f3digo de salida de interrupci\u00f3n que prueba esa rama. . La salida de interrupci\u00f3n prueba esta condici\u00f3n para configurar MSR[EE|RI] para la salida, luego nuevamente en el caso de que se encuentre pendiente una interrupci\u00f3n enmascarada, para recuperar el MSR para que la interrupci\u00f3n pueda reproducirse antes de intentar salir nuevamente. Si la condici\u00f3n cambia entre estas dos pruebas, el estado de la m\u00e1scara suave MSR e irq se da\u00f1ar\u00e1, lo que generar\u00e1 advertencias y posibles fallas. Por ejemplo, si la rama es inicialmente verdadera y luego falsa, MSR[EE] ser\u00e1 0 pero PACA_IRQ_HARD_DIS estar\u00e1 clara y es posible que EE no se habilite, lo que generar\u00e1 advertencias en irq_64.c.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2ea31e2e62bbc4d11c411eeb36f1b02841dbcab1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6f097c24815e67909a1fcc2c605586d02babd673\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/86f7e423933608d536015a0f2eb9e0338c1227e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.