In the Linux kernel, the following vulnerability has been resolved:
um: time-travel: fix time corruption
In 'basic' time-travel mode (without =inf-cpu or =ext), we still get timer interrupts. These can happen at arbitrary points in time, i.e. while in timer_read(), which pushes time forward just a little bit. Then, if we happen to get the interrupt after calculating the new time to push to, but before actually finishing that, the interrupt will set the time to a value that's incompatible with the forward, and we'll crash because time goes backwards when we do the forwarding.
Fix this by reading the timetraveltime, calculating the adjustment, and doing the adjustment all with interrupts disabled.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c7478a2da3f5fe106b4658338873d50c86ac7ab",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "117934482909567910687747987019125961489",
"length": 91.0
},
"id": "CVE-2023-52633-06af0e21",
"target": {
"function": "time_travel_ndelay",
"file": "arch/um/kernel/time.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de3e9d8e8d1ae0a4d301109d1ec140796901306c",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "6095989636611899555819872713539964570",
"length": 318.0
},
"id": "CVE-2023-52633-0addccc8",
"target": {
"function": "timer_read",
"file": "arch/um/kernel/time.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c7478a2da3f5fe106b4658338873d50c86ac7ab",
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265616354708479624281361994069080497147",
"218444132027289608607135201002653234781",
"40552845135562283952618547476615878810",
"220003688708420592292076392472779891205",
"81248920705295868817236768193906371728",
"107772891942014154384530614731483619979",
"201998020752996631990771220453694158019",
"4089633523940725231097294324803306545",
"5541616529541743102745113079448191643",
"237756480133607630917143743249997848939",
"308712766241922368208649659597645886553",
"265995353929360586858740597016505339905",
"259454239740188630707226194176420483762",
"186883267453980756422619190364993443485",
"129496340840403675186576036001975247438",
"280651923646373706108546977179592001377"
]
},
"id": "CVE-2023-52633-11f9ff97",
"target": {
"file": "arch/um/kernel/time.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f7dad73df4cdb2b7042103d3922745d040ad025",
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265616354708479624281361994069080497147",
"218444132027289608607135201002653234781",
"40552845135562283952618547476615878810",
"220003688708420592292076392472779891205",
"81248920705295868817236768193906371728",
"107772891942014154384530614731483619979",
"201998020752996631990771220453694158019",
"4089633523940725231097294324803306545",
"5541616529541743102745113079448191643",
"237756480133607630917143743249997848939",
"308712766241922368208649659597645886553",
"265995353929360586858740597016505339905",
"259454239740188630707226194176420483762",
"186883267453980756422619190364993443485",
"129496340840403675186576036001975247438",
"280651923646373706108546977179592001377"
]
},
"id": "CVE-2023-52633-1962d305",
"target": {
"file": "arch/um/kernel/time.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c7478a2da3f5fe106b4658338873d50c86ac7ab",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "6095989636611899555819872713539964570",
"length": 318.0
},
"id": "CVE-2023-52633-7a317519",
"target": {
"function": "timer_read",
"file": "arch/um/kernel/time.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abe4eaa8618bb36c2b33e9cdde0499296a23448c",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "117934482909567910687747987019125961489",
"length": 91.0
},
"id": "CVE-2023-52633-7d55e540",
"target": {
"function": "time_travel_ndelay",
"file": "arch/um/kernel/time.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b427f55e9d4185f6f17cc1e3296eb8d0c4425283",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "117934482909567910687747987019125961489",
"length": 91.0
},
"id": "CVE-2023-52633-91f42fb9",
"target": {
"function": "time_travel_ndelay",
"file": "arch/um/kernel/time.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b427f55e9d4185f6f17cc1e3296eb8d0c4425283",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "6095989636611899555819872713539964570",
"length": 318.0
},
"id": "CVE-2023-52633-99a2978f",
"target": {
"function": "timer_read",
"file": "arch/um/kernel/time.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abe4eaa8618bb36c2b33e9cdde0499296a23448c",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "6095989636611899555819872713539964570",
"length": 318.0
},
"id": "CVE-2023-52633-9a099efd",
"target": {
"function": "timer_read",
"file": "arch/um/kernel/time.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f7dad73df4cdb2b7042103d3922745d040ad025",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "117934482909567910687747987019125961489",
"length": 91.0
},
"id": "CVE-2023-52633-bb61bc58",
"target": {
"function": "time_travel_ndelay",
"file": "arch/um/kernel/time.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b427f55e9d4185f6f17cc1e3296eb8d0c4425283",
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265616354708479624281361994069080497147",
"218444132027289608607135201002653234781",
"40552845135562283952618547476615878810",
"220003688708420592292076392472779891205",
"81248920705295868817236768193906371728",
"107772891942014154384530614731483619979",
"201998020752996631990771220453694158019",
"4089633523940725231097294324803306545",
"5541616529541743102745113079448191643",
"237756480133607630917143743249997848939",
"308712766241922368208649659597645886553",
"265995353929360586858740597016505339905",
"259454239740188630707226194176420483762",
"186883267453980756422619190364993443485",
"129496340840403675186576036001975247438",
"280651923646373706108546977179592001377"
]
},
"id": "CVE-2023-52633-bc599464",
"target": {
"file": "arch/um/kernel/time.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abe4eaa8618bb36c2b33e9cdde0499296a23448c",
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265616354708479624281361994069080497147",
"218444132027289608607135201002653234781",
"40552845135562283952618547476615878810",
"220003688708420592292076392472779891205",
"81248920705295868817236768193906371728",
"107772891942014154384530614731483619979",
"201998020752996631990771220453694158019",
"4089633523940725231097294324803306545",
"5541616529541743102745113079448191643",
"237756480133607630917143743249997848939",
"308712766241922368208649659597645886553",
"265995353929360586858740597016505339905",
"259454239740188630707226194176420483762",
"186883267453980756422619190364993443485",
"129496340840403675186576036001975247438",
"280651923646373706108546977179592001377"
]
},
"id": "CVE-2023-52633-c76bf9e5",
"target": {
"file": "arch/um/kernel/time.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de3e9d8e8d1ae0a4d301109d1ec140796901306c",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "117934482909567910687747987019125961489",
"length": 91.0
},
"id": "CVE-2023-52633-d6f6307f",
"target": {
"function": "time_travel_ndelay",
"file": "arch/um/kernel/time.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de3e9d8e8d1ae0a4d301109d1ec140796901306c",
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265616354708479624281361994069080497147",
"218444132027289608607135201002653234781",
"40552845135562283952618547476615878810",
"220003688708420592292076392472779891205",
"81248920705295868817236768193906371728",
"107772891942014154384530614731483619979",
"201998020752996631990771220453694158019",
"4089633523940725231097294324803306545",
"5541616529541743102745113079448191643",
"237756480133607630917143743249997848939",
"308712766241922368208649659597645886553",
"265995353929360586858740597016505339905",
"259454239740188630707226194176420483762",
"186883267453980756422619190364993443485",
"129496340840403675186576036001975247438",
"280651923646373706108546977179592001377"
]
},
"id": "CVE-2023-52633-f710e747",
"target": {
"file": "arch/um/kernel/time.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f7dad73df4cdb2b7042103d3922745d040ad025",
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"function_hash": "6095989636611899555819872713539964570",
"length": 318.0
},
"id": "CVE-2023-52633-fcee5b0b",
"target": {
"function": "timer_read",
"file": "arch/um/kernel/time.c"
}
}
]