github - ghsa-2g84-5882-fhcm

GHSA-2G84-5882-FHCM

Vulnerability from github – Published: 2025-03-27 18:31 – Updated: 2025-04-15 15:30

Details

In the Linux kernel, the following vulnerability has been resolved:

acpi: Fix suspend with Xen PV

Commit f1e525009493 ("x86/boot: Skip realmode init code when running as Xen PV guest") missed one code path accessing real_mode_header, leading to dereferencing NULL when suspending the system under Xen:

[  348.284004] PM: suspend entry (deep)
[  348.289532] Filesystems sync: 0.005 seconds
[  348.291545] Freezing user space processes ... (elapsed 0.000 seconds) done.
[  348.292457] OOM killer disabled.
[  348.292462] Freezing remaining freezable tasks ... (elapsed 0.104 seconds) done.
[  348.396612] printk: Suspending console(s) (use no_console_suspend to debug)
[  348.749228] PM: suspend devices took 0.352 seconds
[  348.769713] ACPI: EC: interrupt blocked
[  348.816077] BUG: kernel NULL pointer dereference, address: 000000000000001c
[  348.816080] #PF: supervisor read access in kernel mode
[  348.816081] #PF: error_code(0x0000) - not-present page
[  348.816083] PGD 0 P4D 0
[  348.816086] Oops: 0000 [#1] PREEMPT SMP NOPTI
[  348.816089] CPU: 0 PID: 6764 Comm: systemd-sleep Not tainted 6.1.3-1.fc32.qubes.x86_64 #1
[  348.816092] Hardware name: Star Labs StarBook/StarBook, BIOS 8.01 07/03/2022
[  348.816093] RIP: e030:acpi_get_wakeup_address+0xc/0x20

Fix that by adding an optional acpi callback allowing to skip setting the wakeup address, as in the Xen PV case this will be handled by the hypervisor anyway.

Severity ?

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-52994"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-27T17:15:47Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nacpi: Fix suspend with Xen PV\n\nCommit f1e525009493 (\"x86/boot: Skip realmode init code when running as\nXen PV guest\") missed one code path accessing real_mode_header, leading\nto dereferencing NULL when suspending the system under Xen:\n\n    [  348.284004] PM: suspend entry (deep)\n    [  348.289532] Filesystems sync: 0.005 seconds\n    [  348.291545] Freezing user space processes ... (elapsed 0.000 seconds) done.\n    [  348.292457] OOM killer disabled.\n    [  348.292462] Freezing remaining freezable tasks ... (elapsed 0.104 seconds) done.\n    [  348.396612] printk: Suspending console(s) (use no_console_suspend to debug)\n    [  348.749228] PM: suspend devices took 0.352 seconds\n    [  348.769713] ACPI: EC: interrupt blocked\n    [  348.816077] BUG: kernel NULL pointer dereference, address: 000000000000001c\n    [  348.816080] #PF: supervisor read access in kernel mode\n    [  348.816081] #PF: error_code(0x0000) - not-present page\n    [  348.816083] PGD 0 P4D 0\n    [  348.816086] Oops: 0000 [#1] PREEMPT SMP NOPTI\n    [  348.816089] CPU: 0 PID: 6764 Comm: systemd-sleep Not tainted 6.1.3-1.fc32.qubes.x86_64 #1\n    [  348.816092] Hardware name: Star Labs StarBook/StarBook, BIOS 8.01 07/03/2022\n    [  348.816093] RIP: e030:acpi_get_wakeup_address+0xc/0x20\n\nFix that by adding an optional acpi callback allowing to skip setting\nthe wakeup address, as in the Xen PV case this will be handled by the\nhypervisor anyway.",
  "id": "GHSA-2g84-5882-fhcm",
  "modified": "2025-04-15T15:30:52Z",
  "published": "2025-03-27T18:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52994"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b96903b7fc8c82ddfd92df4cdd83db3e567da0a5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fe0ba8c23f9a35b0307eb662f16dd3a75fcdae41"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2023-52994 (GCVE-0-2023-52994)

Vulnerability from cvelistv5 – Published: 2025-03-27 16:43 – Updated: 2025-10-01 20:17

Summary

In the Linux kernel, the following vulnerability has been resolved: acpi: Fix suspend with Xen PV Commit f1e525009493 ("x86/boot: Skip realmode init code when running as Xen PV guest") missed one code path accessing real_mode_header, leading to dereferencing NULL when suspending the system under Xen: [ 348.284004] PM: suspend entry (deep) [ 348.289532] Filesystems sync: 0.005 seconds [ 348.291545] Freezing user space processes ... (elapsed 0.000 seconds) done. [ 348.292457] OOM killer disabled. [ 348.292462] Freezing remaining freezable tasks ... (elapsed 0.104 seconds) done. [ 348.396612] printk: Suspending console(s) (use no_console_suspend to debug) [ 348.749228] PM: suspend devices took 0.352 seconds [ 348.769713] ACPI: EC: interrupt blocked [ 348.816077] BUG: kernel NULL pointer dereference, address: 000000000000001c [ 348.816080] #PF: supervisor read access in kernel mode [ 348.816081] #PF: error_code(0x0000) - not-present page [ 348.816083] PGD 0 P4D 0 [ 348.816086] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 348.816089] CPU: 0 PID: 6764 Comm: systemd-sleep Not tainted 6.1.3-1.fc32.qubes.x86_64 #1 [ 348.816092] Hardware name: Star Labs StarBook/StarBook, BIOS 8.01 07/03/2022 [ 348.816093] RIP: e030:acpi_get_wakeup_address+0xc/0x20 Fix that by adding an optional acpi callback allowing to skip setting the wakeup address, as in the Xen PV case this will be handled by the hypervisor anyway.

Severity ?

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Assigner

Linux

References

URL

Tags

	https://git.kernel.org/stable/c/b96903b7fc8c82ddf…
	https://git.kernel.org/stable/c/fe0ba8c23f9a35b03…

Impacted products

Vendor

Product

Version

Linux

Affected: b1898793777fe10a31c160bb8bc385d6eea640c6 , < b96903b7fc8c82ddfd92df4cdd83db3e567da0a5 (git)
Affected: f1e525009493cbd569e7c8dd7d58157855f8658d , < fe0ba8c23f9a35b0307eb662f16dd3a75fcdae41 (git)
Affected: 3414632beaadf635a4affd4ae278297978640965 (git)

Linux

Affected: 6.1.2 , < 6.1.9 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-52994",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:08:13.653674Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:17:03.878Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/include/asm/acpi.h",
            "drivers/acpi/sleep.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b96903b7fc8c82ddfd92df4cdd83db3e567da0a5",
              "status": "affected",
              "version": "b1898793777fe10a31c160bb8bc385d6eea640c6",
              "versionType": "git"
            },
            {
              "lessThan": "fe0ba8c23f9a35b0307eb662f16dd3a75fcdae41",
              "status": "affected",
              "version": "f1e525009493cbd569e7c8dd7d58157855f8658d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3414632beaadf635a4affd4ae278297978640965",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/include/asm/acpi.h",
            "drivers/acpi/sleep.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.1.9",
              "status": "affected",
              "version": "6.1.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.9",
                  "versionStartIncluding": "6.1.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nacpi: Fix suspend with Xen PV\n\nCommit f1e525009493 (\"x86/boot: Skip realmode init code when running as\nXen PV guest\") missed one code path accessing real_mode_header, leading\nto dereferencing NULL when suspending the system under Xen:\n\n    [  348.284004] PM: suspend entry (deep)\n    [  348.289532] Filesystems sync: 0.005 seconds\n    [  348.291545] Freezing user space processes ... (elapsed 0.000 seconds) done.\n    [  348.292457] OOM killer disabled.\n    [  348.292462] Freezing remaining freezable tasks ... (elapsed 0.104 seconds) done.\n    [  348.396612] printk: Suspending console(s) (use no_console_suspend to debug)\n    [  348.749228] PM: suspend devices took 0.352 seconds\n    [  348.769713] ACPI: EC: interrupt blocked\n    [  348.816077] BUG: kernel NULL pointer dereference, address: 000000000000001c\n    [  348.816080] #PF: supervisor read access in kernel mode\n    [  348.816081] #PF: error_code(0x0000) - not-present page\n    [  348.816083] PGD 0 P4D 0\n    [  348.816086] Oops: 0000 [#1] PREEMPT SMP NOPTI\n    [  348.816089] CPU: 0 PID: 6764 Comm: systemd-sleep Not tainted 6.1.3-1.fc32.qubes.x86_64 #1\n    [  348.816092] Hardware name: Star Labs StarBook/StarBook, BIOS 8.01 07/03/2022\n    [  348.816093] RIP: e030:acpi_get_wakeup_address+0xc/0x20\n\nFix that by adding an optional acpi callback allowing to skip setting\nthe wakeup address, as in the Xen PV case this will be handled by the\nhypervisor anyway."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T12:50:02.360Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b96903b7fc8c82ddfd92df4cdd83db3e567da0a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe0ba8c23f9a35b0307eb662f16dd3a75fcdae41"
        }
      ],
      "title": "acpi: Fix suspend with Xen PV",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52994",
    "datePublished": "2025-03-27T16:43:28.893Z",
    "dateReserved": "2025-03-27T16:40:15.742Z",
    "dateUpdated": "2025-10-01T20:17:03.878Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-2G84-5882-FHCM

CVE-2023-52994 (GCVE-0-2023-52994)

Tags

Sightings

Nomenclature