In the Linux kernel, the following vulnerability has been resolved:
x86/alternatives: Disable KASAN in apply_alternatives()
Fei has reported that KASAN triggers during apply_alternatives() on a 5-level paging machine:
BUG: KASAN: out-of-bounds in rcu_is_watching()
Read of size 4 at addr ff110003ee6419a0 by task swapper/0/0
...
__asan_load4()
rcu_is_watching()
trace_hardirqs_on()
text_poke_early()
apply_alternatives()
...
On machines with 5-level paging, cpufeatureenabled(X86FEATURELA57) gets patched. It includes KASAN code, where KASANSHADOWSTART depends on _VIRTUALMASKSHIFT, which is defined with cpufeature_enabled().
KASAN gets confused when applyalternatives() patches the KASANSHADOWSTART users. A test patch that makes KASANSHADOWSTART static, by replacing _VIRTUALMASKSHIFT with 56, works around the issue.
Fix it for real by disabling KASAN while the kernel is patching alternatives.
[ mingo: updated the changelog ]
[
{
"signature_version": "v1",
"digest": {
"length": 1287.0,
"function_hash": "149462278117920117029475926757939729686"
},
"signature_type": "Function",
"id": "CVE-2023-52504-070ab9a6",
"target": {
"file": "arch/x86/kernel/alternative.c",
"function": "apply_alternatives"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d35652a5fc9944784f6f50a5c979518ff8dacf61",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90043798340998673140674683821383640026",
"295366953013190714330735122606742203282",
"135994024268613159897850222011319208048",
"84953885958240720414577455276003945367",
"206524018154539633862279683446499931220",
"165514892614816486835019842286062215391",
"281317648798745084511743540551810228046",
"9783131377310485987452081895057142026"
]
},
"signature_type": "Line",
"id": "CVE-2023-52504-1f11bed3",
"target": {
"file": "arch/x86/kernel/alternative.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d35652a5fc9944784f6f50a5c979518ff8dacf61",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"length": 1530.0,
"function_hash": "22958722070101590882518447314756158009"
},
"signature_type": "Function",
"id": "CVE-2023-52504-33008b7d",
"target": {
"file": "arch/x86/kernel/alternative.c",
"function": "apply_alternatives"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6788b10620ca6e98575d1e06e72a8974aad7657e",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"length": 1569.0,
"function_hash": "37494847426076353445434442864922009805"
},
"signature_type": "Function",
"id": "CVE-2023-52504-4e3b62cb",
"target": {
"file": "arch/x86/kernel/alternative.c",
"function": "apply_alternatives"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3719d3c36aa853d5a2401af9f8d6b116c91ad5ae",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"length": 1534.0,
"function_hash": "229091366414417447286407287687231715900"
},
"signature_type": "Function",
"id": "CVE-2023-52504-592f4f3d",
"target": {
"file": "arch/x86/kernel/alternative.c",
"function": "apply_alternatives"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecba5afe86f30605eb9dfb7f265a8de0218d4cfc",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"102422200057739349867661915679582681651",
"198450145244305732107802463236938126299",
"311940196090750136641156815346469477728",
"227484162115683587651514608898183709066",
"339106090515817008739547059791365669098",
"264796833091151060092569286668539074943",
"157270853670106404612904198927869557558",
"61428237383483738941696394538691974939"
]
},
"signature_type": "Line",
"id": "CVE-2023-52504-60ef5bb8",
"target": {
"file": "arch/x86/kernel/alternative.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecba5afe86f30605eb9dfb7f265a8de0218d4cfc",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"102422200057739349867661915679582681651",
"198450145244305732107802463236938126299",
"311940196090750136641156815346469477728",
"227484162115683587651514608898183709066",
"339106090515817008739547059791365669098",
"264796833091151060092569286668539074943",
"157270853670106404612904198927869557558",
"61428237383483738941696394538691974939"
]
},
"signature_type": "Line",
"id": "CVE-2023-52504-774683e5",
"target": {
"file": "arch/x86/kernel/alternative.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6788b10620ca6e98575d1e06e72a8974aad7657e",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"118402653939614760068456090873710450172",
"303143970034861055090874841023832899829",
"154095620285436324713944147167714443638",
"209440575736124254751201794196942218905",
"179882114964377646526029147591242552216",
"144232549072179630770739781870956792835",
"251263578750727566203286426714956132741",
"255380274647421880502760285566296364408"
]
},
"signature_type": "Line",
"id": "CVE-2023-52504-9d4e9daf",
"target": {
"file": "arch/x86/kernel/alternative.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3719d3c36aa853d5a2401af9f8d6b116c91ad5ae",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"length": 1581.0,
"function_hash": "62638960290554023399183056942904651791"
},
"signature_type": "Function",
"id": "CVE-2023-52504-a870e930",
"target": {
"file": "arch/x86/kernel/alternative.c",
"function": "apply_alternatives"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3770c38cd6a60494da29ac2da73ff8156440a2d1",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"length": 1534.0,
"function_hash": "229091366414417447286407287687231715900"
},
"signature_type": "Function",
"id": "CVE-2023-52504-ab3dc5e9",
"target": {
"file": "arch/x86/kernel/alternative.c",
"function": "apply_alternatives"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b784489c8158518bf7a466bb3cc045b0fb66b4b",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"102422200057739349867661915679582681651",
"198450145244305732107802463236938126299",
"311940196090750136641156815346469477728",
"227484162115683587651514608898183709066",
"339106090515817008739547059791365669098",
"264796833091151060092569286668539074943",
"24039380647311116655315214475903127412",
"9783131377310485987452081895057142026"
]
},
"signature_type": "Line",
"id": "CVE-2023-52504-cb5f2fce",
"target": {
"file": "arch/x86/kernel/alternative.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b784489c8158518bf7a466bb3cc045b0fb66b4b",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"102422200057739349867661915679582681651",
"198450145244305732107802463236938126299",
"311940196090750136641156815346469477728",
"177522001037271837955380338379593367845",
"114283156862354037186269614727115254625",
"293296657676200418885125329891004191301",
"134068240465476075412364759500957880811",
"255380274647421880502760285566296364408"
]
},
"signature_type": "Line",
"id": "CVE-2023-52504-e5af53ef",
"target": {
"file": "arch/x86/kernel/alternative.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3770c38cd6a60494da29ac2da73ff8156440a2d1",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"90043798340998673140674683821383640026",
"295366953013190714330735122606742203282",
"135994024268613159897850222011319208048",
"84953885958240720414577455276003945367",
"206524018154539633862279683446499931220",
"165514892614816486835019842286062215391",
"281317648798745084511743540551810228046",
"9783131377310485987452081895057142026"
]
},
"signature_type": "Line",
"id": "CVE-2023-52504-eabd454b",
"target": {
"file": "arch/x86/kernel/alternative.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd287cc208dfe6bd6da98e7f88e723209242c9b4",
"deprecated": false
},
{
"signature_version": "v1",
"digest": {
"length": 1287.0,
"function_hash": "149462278117920117029475926757939729686"
},
"signature_type": "Function",
"id": "CVE-2023-52504-f17581ed",
"target": {
"file": "arch/x86/kernel/alternative.c",
"function": "apply_alternatives"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd287cc208dfe6bd6da98e7f88e723209242c9b4",
"deprecated": false
}
]