CVE-2023-52506

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-52506
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52506.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-52506
Downstream
Published
2024-03-02T21:52:20Z
Modified
2025-10-21T14:13:52.473854Z
Summary
LoongArch: Set all reserved memblocks on Node#0 at initialization
Details

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: Set all reserved memblocks on Node#0 at initialization

After commit 61167ad5fecdea ("mm: pass nid to reservebootmemregion()") we get a panic if DEFERREDSTRUCTPAGE_INIT is enabled:

[ 0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000000000002b82, era == 90000000040e3f28, ra == 90000000040e3f18 [ 0.000000] pc 90000000040e3f28 ra 90000000040e3f18 tp 90000000046f4000 sp 90000000046f7c90 [ 0.000000] a0 0000000000000001 a1 0000000000200000 a2 0000000000000040 a3 90000000046f7ca0 [ 0.000000] a4 90000000046f7ca4 a5 0000000000000000 a6 90000000046f7c38 a7 0000000000000000 [ 0.000000] t0 0000000000000002 t1 9000000004b00ac8 t2 90000000040e3f18 t3 90000000040f0800 [ 0.000000] t4 00000000000f0000 t5 80000000ffffe07e t6 0000000000000003 t7 900000047fff5e20 [ 0.000000] t8 aaaaaaaaaaaaaaab u0 0000000000000018 s9 0000000000000000 s0 fffffefffe000000 [ 0.000000] s1 0000000000000000 s2 0000000000000080 s3 0000000000000040 s4 0000000000000000 [ 0.000000] s5 0000000000000000 s6 fffffefffe000000 s7 900000000470b740 s8 9000000004ad4000 [ 0.000000] ra: 90000000040e3f18 reservebootmemregion+0xec/0x21c [ 0.000000] ERA: 90000000040e3f28 reservebootmemregion+0xfc/0x21c [ 0.000000] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [ 0.000000] PRMD: 00000000 (PPLV0 -PIE -PWE) [ 0.000000] EUEN: 00000000 (-FPE -SXE -ASXE -BTE) [ 0.000000] ECFG: 00070800 (LIE=11 VS=7) [ 0.000000] ESTAT: 00010800 [PIL] (IS=11 ECode=1 EsubCode=0) [ 0.000000] BADV: 0000000000002b82 [ 0.000000] PRID: 0014d000 (Loongson-64bit, Loongson-3A6000) [ 0.000000] Modules linked in: [ 0.000000] Process swapper (pid: 0, threadinfo=(_ptrval), task=(ptrval)) [ 0.000000] Stack : 0000000000000000 9000000002eb5430 0000003a00000020 90000000045ccd00 [ 0.000000] 900000000470e000 90000000002c1918 0000000000000000 9000000004110780 [ 0.000000] 00000000fe6c0000 0000000480000000 9000000004b4e368 9000000004110748 [ 0.000000] 0000000000000000 900000000421ca84 9000000004620000 9000000004564970 [ 0.000000] 90000000046f7d78 9000000002cc9f70 90000000002c1918 900000000470e000 [ 0.000000] 9000000004564970 90000000040bc0e0 90000000046f7d78 0000000000000000 [ 0.000000] 0000000000004000 90000000045ccd00 0000000000000000 90000000002c1918 [ 0.000000] 90000000002c1900 900000000470b700 9000000004b4df78 9000000004620000 [ 0.000000] 90000000046200a8 90000000046200a8 0000000000000000 9000000004218b2c [ 0.000000] 9000000004270008 0000000000000001 0000000000000000 90000000045ccd00 [ 0.000000] ... [ 0.000000] Call Trace: [ 0.000000] [<90000000040e3f28>] reservebootmemregion+0xfc/0x21c [ 0.000000] [<900000000421ca84>] memblockfreeall+0x114/0x350 [ 0.000000] [<9000000004218b2c>] mmcoreinit+0x138/0x3cc [ 0.000000] [<9000000004200e38>] startkernel+0x488/0x7a4 [ 0.000000] [<90000000040df0d8>] kernel_entry+0xd8/0xdc [ 0.000000] [ 0.000000] Code: 02eb21ad 00410f4c 380c31ac <262b818d> 6800b70d 02c1c196 0015001c 57fe4bb1 260002cd

The reason is early memblockreserve() in memblockinit() set node id to MAXNUMNODES, making NODEDATA(nid) a NULL dereference in the call chain reservebootmemregion() -> initreservedpage(). After memblockinit(), those late calls of memblockreserve() operate on subregions of memblock .memory regions. As a result, these reserved regions will be set to the correct node at the first iteration of memmapinitreserved_pages().

So set all reserved memblocks on Node#0 at initialization can avoid this panic.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
fa96b57c149061f71a70bd6582d995f6424fbbf4
Fixed
f105e893a8edd48bdf4bef9fef845a9ff402f737
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
fa96b57c149061f71a70bd6582d995f6424fbbf4
Fixed
19878758accf6b2788091a771d9f9fee7bab11ab
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
fa96b57c149061f71a70bd6582d995f6424fbbf4
Fixed
b795fb9f5861ee256070d59e33130980a01fadd7

Affected versions

v5.*

v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8

v6.*

v6.0
v6.0-rc1
v6.0-rc2
v6.0-rc3
v6.0-rc4
v6.0-rc5
v6.0-rc6
v6.0-rc7
v6.1
v6.1-rc1
v6.1-rc2
v6.1-rc3
v6.1-rc4
v6.1-rc5
v6.1-rc6
v6.1-rc7
v6.1-rc8
v6.1.1
v6.1.10
v6.1.11
v6.1.12
v6.1.13
v6.1.14
v6.1.15
v6.1.16
v6.1.17
v6.1.18
v6.1.19
v6.1.2
v6.1.20
v6.1.21
v6.1.22
v6.1.23
v6.1.24
v6.1.25
v6.1.26
v6.1.27
v6.1.28
v6.1.29
v6.1.3
v6.1.30
v6.1.31
v6.1.32
v6.1.33
v6.1.34
v6.1.35
v6.1.36
v6.1.37
v6.1.38
v6.1.39
v6.1.4
v6.1.40
v6.1.41
v6.1.42
v6.1.43
v6.1.44
v6.1.45
v6.1.46
v6.1.47
v6.1.48
v6.1.49
v6.1.5
v6.1.50
v6.1.51
v6.1.52
v6.1.53
v6.1.54
v6.1.55
v6.1.6
v6.1.7
v6.1.8
v6.1.9
v6.2
v6.2-rc1
v6.2-rc2
v6.2-rc3
v6.2-rc4
v6.2-rc5
v6.2-rc6
v6.2-rc7
v6.2-rc8
v6.3
v6.3-rc1
v6.3-rc2
v6.3-rc3
v6.3-rc4
v6.3-rc5
v6.3-rc6
v6.3-rc7
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.5.1
v6.5.2
v6.5.3
v6.5.4
v6.5.5
v6.6-rc1
v6.6-rc2

Database specific

vanir_signatures

[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19878758accf6b2788091a771d9f9fee7bab11ab",
        "target": {
            "file": "arch/loongarch/kernel/mem.c"
        },
        "id": "CVE-2023-52506-01dfb504",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "75092653781781963356673605093994578826",
                "221444933664793012447996163359694778462",
                "35395956379648971706615372107062154264",
                "294723885919494803859726308273513020358",
                "261276887995147892511145083714699857641"
            ]
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b795fb9f5861ee256070d59e33130980a01fadd7",
        "target": {
            "file": "arch/loongarch/kernel/mem.c",
            "function": "memblock_init"
        },
        "id": "CVE-2023-52506-19b3fd83",
        "signature_type": "Function",
        "digest": {
            "function_hash": "136112075968499437148218776359297431666",
            "length": 1042.0
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f105e893a8edd48bdf4bef9fef845a9ff402f737",
        "target": {
            "file": "arch/loongarch/kernel/mem.c",
            "function": "memblock_init"
        },
        "id": "CVE-2023-52506-509e7ae2",
        "signature_type": "Function",
        "digest": {
            "function_hash": "136112075968499437148218776359297431666",
            "length": 1042.0
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b795fb9f5861ee256070d59e33130980a01fadd7",
        "target": {
            "file": "arch/loongarch/kernel/mem.c"
        },
        "id": "CVE-2023-52506-a75c50ef",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "75092653781781963356673605093994578826",
                "221444933664793012447996163359694778462",
                "35395956379648971706615372107062154264",
                "294723885919494803859726308273513020358",
                "261276887995147892511145083714699857641"
            ]
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f105e893a8edd48bdf4bef9fef845a9ff402f737",
        "target": {
            "file": "arch/loongarch/kernel/mem.c"
        },
        "id": "CVE-2023-52506-fd74e52e",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "75092653781781963356673605093994578826",
                "221444933664793012447996163359694778462",
                "35395956379648971706615372107062154264",
                "294723885919494803859726308273513020358",
                "261276887995147892511145083714699857641"
            ]
        },
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19878758accf6b2788091a771d9f9fee7bab11ab",
        "target": {
            "file": "arch/loongarch/kernel/mem.c",
            "function": "memblock_init"
        },
        "id": "CVE-2023-52506-ff3b9db0",
        "signature_type": "Function",
        "digest": {
            "function_hash": "136112075968499437148218776359297431666",
            "length": 1042.0
        },
        "deprecated": false,
        "signature_version": "v1"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.19.0
Fixed
6.1.56
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.5.6