GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54092 (GCVE-0-2023-54092)

Vulnerability from cvelistv5 – Published: 2025-12-24 13:06 – Updated: 2026-08-05 09:17
VLAI
Title
KVM: s390: pv: fix index value of replaced ASCE
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pv: fix index value of replaced ASCE The index field of the struct page corresponding to a guest ASCE should be 0. When replacing the ASCE in s390_replace_asce(), the index of the new ASCE should also be set to 0. Having the wrong index might lead to the wrong addresses being passed around when notifying pte invalidations, and eventually to validity intercepts (VM crash) if the prefix gets unmapped and the notifier gets called with the wrong address.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9d216035d173214cd33712d67d89220ef2283ebf , < 8e635da0e0d3cb45e32fa79b36218fb98281bc10 (git)
Affected: 81ea65c9aefe100a9ace3082649bd84ae7dd9764 , < 49a2686adddebe1ae76b4d368383208656ef6606 (git)
Affected: faa2f72cb3569256480c5540d242c84e99965160 , < 017f686bcb536ff23d49c143fdf9d1fd89a9a924 (git)
Affected: faa2f72cb3569256480c5540d242c84e99965160 , < f1c7a776338f2ac5e34da40e58fe9f33ea390a5e (git)
Affected: faa2f72cb3569256480c5540d242c84e99965160 , < c2fceb59bbda16468bda82b002383bff59de89ab (git)
Affected: b5477f53e1d4de6191f50748a027251b14952eeb (git)
Affected: 63c71e83d5b6ab8adb5fcebef977052048016957 (git)
Affected: 5.10.137 , < 5.10.190 (semver)
Affected: 5.15.61 , < 5.15.124 (semver)
Affected: 5.18.18 , < 5.19 (semver)
Affected: 5.19.2 , < 5.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 5.10.190 , ≤ 5.10.* (semver)
Unaffected: 5.15.124 , ≤ 5.15.* (semver)
Unaffected: 6.1.43 , ≤ 6.1.* (semver)
Unaffected: 6.4.8 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/mm/gmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8e635da0e0d3cb45e32fa79b36218fb98281bc10",
              "status": "affected",
              "version": "9d216035d173214cd33712d67d89220ef2283ebf",
              "versionType": "git"
            },
            {
              "lessThan": "49a2686adddebe1ae76b4d368383208656ef6606",
              "status": "affected",
              "version": "81ea65c9aefe100a9ace3082649bd84ae7dd9764",
              "versionType": "git"
            },
            {
              "lessThan": "017f686bcb536ff23d49c143fdf9d1fd89a9a924",
              "status": "affected",
              "version": "faa2f72cb3569256480c5540d242c84e99965160",
              "versionType": "git"
            },
            {
              "lessThan": "f1c7a776338f2ac5e34da40e58fe9f33ea390a5e",
              "status": "affected",
              "version": "faa2f72cb3569256480c5540d242c84e99965160",
              "versionType": "git"
            },
            {
              "lessThan": "c2fceb59bbda16468bda82b002383bff59de89ab",
              "status": "affected",
              "version": "faa2f72cb3569256480c5540d242c84e99965160",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b5477f53e1d4de6191f50748a027251b14952eeb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "63c71e83d5b6ab8adb5fcebef977052048016957",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.190",
              "status": "affected",
              "version": "5.10.137",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.124",
              "status": "affected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThan": "5.20",
              "status": "affected",
              "version": "5.19.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/mm/gmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.190",
                  "versionStartIncluding": "5.10.137",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.124",
                  "versionStartIncluding": "5.15.61",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.43",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.8",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.19.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pv: fix index value of replaced ASCE\n\nThe index field of the struct page corresponding to a guest ASCE should\nbe 0. When replacing the ASCE in s390_replace_asce(), the index of the\nnew ASCE should also be set to 0.\n\nHaving the wrong index might lead to the wrong addresses being passed\naround when notifying pte invalidations, and eventually to validity\nintercepts (VM crash) if the prefix gets unmapped and the notifier gets\ncalled with the wrong address."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is entered through the local KVM_S390_PV_COMMAND ioctl on /dev/kvm (KVM_PV_ASYNC_CLEANUP_PREPARE) or the PV deinit path, requiring local access to the host; alternatively it is driven by a hosted guest rebooting out of secure mode. There is no network-facing entry point.\nAC:L - The attacker owning the VM controls every relevant precondition \u2014 the guest size that selects a segment-type ASCE, the timing and repetition of the secure-to-normal teardown, and page-allocator grooming that determines the stale page-\u003eindex handed back by alloc_pages. Repeated reboot/teardown cycles let the attacker retry freely, so no condition lies outside the attacker\u0027s influence.\nPR:L - Triggering requires only the ability to open /dev/kvm and create/run a protected VM, which is granted to ordinary unprivileged accounts (kvm group / VMM service user) rather than real root; the same path is reachable by an already-running guest that reboots.\nUI:N - No victim action is needed \u2014 the guest reboot or the ioctl sequence issued by the attacker\u0027s own VMM drives the whole sequence automatically.\nS:C - The defect is in host kernel gmap/KVM code but its effects land across the guest/host virtualization boundary: missed prefix notifications crash the guest VM, and the mis-addressed IDTE leaves guest TLB translations alive for host pages the host has already unmapped, giving the guest reach outside its assigned memory.\nC:H - Because __pmdp_idte() purges the TLB for the wrong guest address while the pmd entry is cleared, the guest retains a valid stale translation to a host page that is subsequently freed and reallocated, allowing it to read arbitrary reused host memory.\nI:H - The same stale translation is writable, so the guest can corrupt host memory that has been recycled for other purposes; in addition, corrupted gaddr values drive DAT-table invalidation and gmap pmd bookkeeping with attacker-influenced wrong addresses.\nA:H - The commit itself states the wrong index leads to validity intercepts and a VM crash when the prefix is unmapped and the notifier is called with the wrong address, and the condition can be re-triggered on every teardown cycle."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:10.381Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8e635da0e0d3cb45e32fa79b36218fb98281bc10"
        },
        {
          "url": "https://git.kernel.org/stable/c/49a2686adddebe1ae76b4d368383208656ef6606"
        },
        {
          "url": "https://git.kernel.org/stable/c/017f686bcb536ff23d49c143fdf9d1fd89a9a924"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1c7a776338f2ac5e34da40e58fe9f33ea390a5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2fceb59bbda16468bda82b002383bff59de89ab"
        }
      ],
      "title": "KVM: s390: pv: fix index value of replaced ASCE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54092",
    "datePublished": "2025-12-24T13:06:21.092Z",
    "dateReserved": "2025-12-24T13:02:52.516Z",
    "dateUpdated": "2026-08-05T09:17:10.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54092",
      "date": "2026-09-16",
      "epss": "0.00204",
      "percentile": "0.10536"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-54092\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T13:16:11.073\",\"lastModified\":\"2026-08-04T10:19:28.610\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: s390: pv: fix index value of replaced ASCE\\n\\nThe index field of the struct page corresponding to a guest ASCE should\\nbe 0. When replacing the ASCE in s390_replace_asce(), the index of the\\nnew ASCE should also be set to 0.\\n\\nHaving the wrong index might lead to the wrong addresses being passed\\naround when notifying pte invalidations, and eventually to validity\\nintercepts (VM crash) if the prefix gets unmapped and the notifier gets\\ncalled with the wrong address.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/s390/mm/gmap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9d216035d173214cd33712d67d89220ef2283ebf\",\"lessThan\":\"8e635da0e0d3cb45e32fa79b36218fb98281bc10\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"81ea65c9aefe100a9ace3082649bd84ae7dd9764\",\"lessThan\":\"49a2686adddebe1ae76b4d368383208656ef6606\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"faa2f72cb3569256480c5540d242c84e99965160\",\"lessThan\":\"017f686bcb536ff23d49c143fdf9d1fd89a9a924\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"faa2f72cb3569256480c5540d242c84e99965160\",\"lessThan\":\"f1c7a776338f2ac5e34da40e58fe9f33ea390a5e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"faa2f72cb3569256480c5540d242c84e99965160\",\"lessThan\":\"c2fceb59bbda16468bda82b002383bff59de89ab\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b5477f53e1d4de6191f50748a027251b14952eeb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"63c71e83d5b6ab8adb5fcebef977052048016957\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.137\",\"lessThan\":\"5.10.190\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.61\",\"lessThan\":\"5.15.124\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.18.18\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.19.2\",\"lessThan\":\"5.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/s390/mm/gmap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.190\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.124\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.43\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.8\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/017f686bcb536ff23d49c143fdf9d1fd89a9a924\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/49a2686adddebe1ae76b4d368383208656ef6606\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8e635da0e0d3cb45e32fa79b36218fb98281bc10\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c2fceb59bbda16468bda82b002383bff59de89ab\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f1c7a776338f2ac5e34da40e58fe9f33ea390a5e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:14:35+00:00",
      "cve": "CVE-2023-54092",
      "id": "CVE-2023-54092",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: s390: pv: fix index value of replaced ASCE",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54092.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:03:57Z",
      "cve": "CVE-2023-54092",
      "id": "CVE-2023-54092",
      "initial_release_date": "2025-12-25T00:55:49Z",
      "product_status:known_affected": "401",
      "product_status:known_not_affected": "236",
      "product_status:recommended": "437",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54092",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54092.json",
      "version": "39"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.