In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: vsie: fix race during shadow creation
Right now it is possible to see gmap->private being zero in kvms390vsiegmapnotifier resulting in a crash. This is due to the fact that we add gmap->private == kvm after creation:
static int acquiregmapshadow(struct kvmvcpu *vcpu, struct vsiepage *vsiepage) { [...] gmap = gmapshadow(vcpu->arch.gmap, asce, edat); if (ISERR(gmap)) return PTRERR(gmap); gmap->private = vcpu->kvm;
Let children inherit the private field of the parent.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28bb27824f25f36e5f80229a358d66ee09244082",
"id": "CVE-2023-52639-00200065",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "gmap_shadow",
"file": "arch/s390/mm/gmap.c"
},
"digest": {
"length": 1791.0,
"function_hash": "48315511877775570578636821338410557270"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5df3b81a567eb565029563f26f374ae3803a1dfc",
"id": "CVE-2023-52639-253c27f9",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "acquire_gmap_shadow",
"file": "arch/s390/kvm/vsie.c"
},
"digest": {
"length": 686.0,
"function_hash": "111605409058757849847891541948731442935"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe752331d4b361d43cfd0b89534b4b2176057c32",
"id": "CVE-2023-52639-30de803a",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "gmap_shadow",
"file": "arch/s390/mm/gmap.c"
},
"digest": {
"length": 1791.0,
"function_hash": "48315511877775570578636821338410557270"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5df3b81a567eb565029563f26f374ae3803a1dfc",
"id": "CVE-2023-52639-375d4b7c",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "gmap_shadow",
"file": "arch/s390/mm/gmap.c"
},
"digest": {
"length": 1791.0,
"function_hash": "48315511877775570578636821338410557270"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe752331d4b361d43cfd0b89534b4b2176057c32",
"id": "CVE-2023-52639-394ec665",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "arch/s390/mm/gmap.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"109566262558223937272061792956224135862",
"112984374158968044827008249150014708179",
"333624546225272931129255186199480469947",
"267563349690046194654045115739092486004"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28bb27824f25f36e5f80229a358d66ee09244082",
"id": "CVE-2023-52639-4c27b506",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "arch/s390/mm/gmap.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"109566262558223937272061792956224135862",
"112984374158968044827008249150014708179",
"333624546225272931129255186199480469947",
"267563349690046194654045115739092486004"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe752331d4b361d43cfd0b89534b4b2176057c32",
"id": "CVE-2023-52639-68c73b30",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "acquire_gmap_shadow",
"file": "arch/s390/kvm/vsie.c"
},
"digest": {
"length": 686.0,
"function_hash": "111605409058757849847891541948731442935"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28bb27824f25f36e5f80229a358d66ee09244082",
"id": "CVE-2023-52639-802a040a",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "arch/s390/kvm/vsie.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"315920808901369331236196984722823038032",
"173969770650467067988145132573828081309",
"133289241105036107607248850527811824227",
"265358627423338540662615864027210319534"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5572c0323cf8b4f1f0618178648a25b8fb8a380",
"id": "CVE-2023-52639-93e0924c",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "acquire_gmap_shadow",
"file": "arch/s390/kvm/vsie.c"
},
"digest": {
"length": 686.0,
"function_hash": "111605409058757849847891541948731442935"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5572c0323cf8b4f1f0618178648a25b8fb8a380",
"id": "CVE-2023-52639-95530d01",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "arch/s390/mm/gmap.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"109566262558223937272061792956224135862",
"112984374158968044827008249150014708179",
"333624546225272931129255186199480469947",
"267563349690046194654045115739092486004"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe752331d4b361d43cfd0b89534b4b2176057c32",
"id": "CVE-2023-52639-cc1f045d",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "arch/s390/kvm/vsie.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"315920808901369331236196984722823038032",
"173969770650467067988145132573828081309",
"133289241105036107607248850527811824227",
"265358627423338540662615864027210319534"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5572c0323cf8b4f1f0618178648a25b8fb8a380",
"id": "CVE-2023-52639-ccc44e25",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "gmap_shadow",
"file": "arch/s390/mm/gmap.c"
},
"digest": {
"length": 1791.0,
"function_hash": "48315511877775570578636821338410557270"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5df3b81a567eb565029563f26f374ae3803a1dfc",
"id": "CVE-2023-52639-d90b89c6",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "arch/s390/mm/gmap.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"109566262558223937272061792956224135862",
"112984374158968044827008249150014708179",
"333624546225272931129255186199480469947",
"267563349690046194654045115739092486004"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28bb27824f25f36e5f80229a358d66ee09244082",
"id": "CVE-2023-52639-daa52c9d",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "acquire_gmap_shadow",
"file": "arch/s390/kvm/vsie.c"
},
"digest": {
"length": 686.0,
"function_hash": "111605409058757849847891541948731442935"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5572c0323cf8b4f1f0618178648a25b8fb8a380",
"id": "CVE-2023-52639-ee0aecd9",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "arch/s390/kvm/vsie.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"315920808901369331236196984722823038032",
"173969770650467067988145132573828081309",
"133289241105036107607248850527811824227",
"265358627423338540662615864027210319534"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5df3b81a567eb565029563f26f374ae3803a1dfc",
"id": "CVE-2023-52639-ff7d90ae",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "arch/s390/kvm/vsie.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"315920808901369331236196984722823038032",
"173969770650467067988145132573828081309",
"133289241105036107607248850527811824227",
"265358627423338540662615864027210319534"
]
},
"signature_type": "Line"
}
]