In the Linux kernel, the following vulnerability has been resolved:
acpi: Fix suspend with Xen PV
Commit f1e525009493 ("x86/boot: Skip realmode init code when running as Xen PV guest") missed one code path accessing realmodeheader, leading to dereferencing NULL when suspending the system under Xen:
[ 348.284004] PM: suspend entry (deep)
[ 348.289532] Filesystems sync: 0.005 seconds
[ 348.291545] Freezing user space processes ... (elapsed 0.000 seconds) done.
[ 348.292457] OOM killer disabled.
[ 348.292462] Freezing remaining freezable tasks ... (elapsed 0.104 seconds) done.
[ 348.396612] printk: Suspending console(s) (use no_console_suspend to debug)
[ 348.749228] PM: suspend devices took 0.352 seconds
[ 348.769713] ACPI: EC: interrupt blocked
[ 348.816077] BUG: kernel NULL pointer dereference, address: 000000000000001c
[ 348.816080] #PF: supervisor read access in kernel mode
[ 348.816081] #PF: error_code(0x0000) - not-present page
[ 348.816083] PGD 0 P4D 0
[ 348.816086] Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 348.816089] CPU: 0 PID: 6764 Comm: systemd-sleep Not tainted 6.1.3-1.fc32.qubes.x86_64 #1
[ 348.816092] Hardware name: Star Labs StarBook/StarBook, BIOS 8.01 07/03/2022
[ 348.816093] RIP: e030:acpi_get_wakeup_address+0xc/0x20
Fix that by adding an optional acpi callback allowing to skip setting the wakeup address, as in the Xen PV case this will be handled by the hypervisor anyway.
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b96903b7fc8c82ddfd92df4cdd83db3e567da0a5",
"id": "CVE-2023-52994-35231e71",
"digest": {
"function_hash": "195612119955233538328971134353113195726",
"length": 323.0
},
"target": {
"function": "acpi_sleep_prepare",
"file": "drivers/acpi/sleep.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe0ba8c23f9a35b0307eb662f16dd3a75fcdae41",
"id": "CVE-2023-52994-8b3acd89",
"digest": {
"threshold": 0.9,
"line_hashes": [
"106363845156747874334092895612538854839",
"87606996388362640892420949281050580796",
"318861494165023164871837346510110253451",
"93967512389163026933190005820634406331",
"196175789149453475756022443312425622724",
"45208207115109774580542348841001313767",
"189763840687608299967627027779005886965"
]
},
"target": {
"file": "arch/x86/include/asm/acpi.h"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe0ba8c23f9a35b0307eb662f16dd3a75fcdae41",
"id": "CVE-2023-52994-9b49502a",
"digest": {
"function_hash": "195612119955233538328971134353113195726",
"length": 323.0
},
"target": {
"function": "acpi_sleep_prepare",
"file": "drivers/acpi/sleep.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b96903b7fc8c82ddfd92df4cdd83db3e567da0a5",
"id": "CVE-2023-52994-aa92b683",
"digest": {
"threshold": 0.9,
"line_hashes": [
"106363845156747874334092895612538854839",
"87606996388362640892420949281050580796",
"318861494165023164871837346510110253451",
"93967512389163026933190005820634406331",
"196175789149453475756022443312425622724",
"45208207115109774580542348841001313767",
"189763840687608299967627027779005886965"
]
},
"target": {
"file": "arch/x86/include/asm/acpi.h"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe0ba8c23f9a35b0307eb662f16dd3a75fcdae41",
"id": "CVE-2023-52994-bf85beca",
"digest": {
"threshold": 0.9,
"line_hashes": [
"292860425422133009934236558733170443561",
"283254949423632958894581539020005082148",
"181976981613130190930284195935602153122",
"291434652287236494158956304511196616751",
"221111103258340819266011151572912504670",
"159156671790736144374095659876481104699",
"126072938625261691724779790474552584302",
"225321599157468265145393861563671626073"
]
},
"target": {
"file": "drivers/acpi/sleep.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b96903b7fc8c82ddfd92df4cdd83db3e567da0a5",
"id": "CVE-2023-52994-deada140",
"digest": {
"threshold": 0.9,
"line_hashes": [
"292860425422133009934236558733170443561",
"283254949423632958894581539020005082148",
"181976981613130190930284195935602153122",
"291434652287236494158956304511196616751",
"221111103258340819266011151572912504670",
"159156671790736144374095659876481104699",
"126072938625261691724779790474552584302",
"225321599157468265145393861563671626073"
]
},
"target": {
"file": "drivers/acpi/sleep.c"
},
"signature_type": "Line",
"signature_version": "v1"
}
]