In the Linux kernel, the following vulnerability has been resolved:
net/iucv: Fix size of interrupt data
iucvirqdata needs to be 4 bytes larger. These bytes are not used by the iucv module, but written by the z/VM hypervisor in case a CPU is deconfigured.
Reported as:
0x0000000000400564-0x0000000000400567 @offset=1380. First byte 0x80 instead of 0xcc Allocated in iucvcpuprepare+0x44/0xd0 age=167839 cpu=2 pid=1 _kmemcacheallocnode+0x166/0x450 kmallocnodetrace+0x3a/0x70 iucvcpuprepare+0x44/0xd0 cpuhpinvokecallback+0x156/0x2f0 cpuhpissuecall+0xf0/0x298 _cpuhpsetupstatecpuslocked+0x136/0x338 _cpuhpsetupstate+0xf4/0x288 iucvinit+0xf4/0x280 dooneinitcall+0x78/0x390 doinitcalls+0x11a/0x140 kernelinitfreeable+0x25e/0x2a0 kernelinit+0x2e/0x170 _retfromfork+0x3c/0x58 retfromfork+0xa/0x40 Freed in iucvinit+0x92/0x280 age=167839 cpu=2 pid=1 _kmemcachefree+0x308/0x358 iucvinit+0x92/0x280 dooneinitcall+0x78/0x390 doinitcalls+0x11a/0x140 kernelinitfreeable+0x25e/0x2a0 kernelinit+0x2e/0x170 _retfromfork+0x3c/0x58 retfromfork+0xa/0x40 Slab 0x0000037200010000 objects=32 used=30 fp=0x0000000000400640 flags=0x1ffff00000010200(slab|head|node=0|zone=0| Object 0x0000000000400540 @offset=1344 fp=0x0000000000000000 Redzone 0000000000400500: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ Redzone 0000000000400510: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ Redzone 0000000000400520: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ Redzone 0000000000400530: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ Object 0000000000400540: 00 01 00 03 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object 0000000000400550: f3 86 81 f2 f4 82 f8 82 f0 f0 f0 f0 f0 f0 f0 f2 ................ Object 0000000000400560: 00 00 00 00 80 00 00 00 cc cc cc cc cc cc cc cc ................ Object 0000000000400570: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ Redzone 0000000000400580: cc cc cc cc cc cc cc cc ........ Padding 00000000004005d4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ Padding 00000000004005e4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ Padding 00000000004005f4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ CPU: 6 PID: 121030 Comm: 116-pai-crypto. Not tainted 6.3.0-20230221.rc0.git4.99b8246b2d71.300.fc37.s390x+debug #1 Hardware name: IBM 3931 A01 704 (z/VM 7.3.0) Call Trace: [<000000032aa034ec>] dumpstacklvl+0xac/0x100 [<0000000329f5a6cc>] checkbytesandreport+0x104/0x140 [<0000000329f5aa78>] checkobject+0x370/0x3c0 [<0000000329f5ede6>] freedebugprocessing+0x15e/0x348 [<0000000329f5f06a>] freetopartiallist+0x9a/0x2f0 [<0000000329f5f4a4>] _slabfree+0x1e4/0x3a8 [<0000000329f61768>] _kmemcachefree+0x308/0x358 [<000000032a91465c>] iucvcpudead+0x6c/0x88 [<0000000329c2fc66>] cpuhpinvokecallback+0x156/0x2f0 [<000000032aa062da>] _cpudown.constprop.0+0x22a/0x5e0 [<0000000329c3243e>] cpudevicedown+0x4e/0x78 [<000000032a61dee0>] deviceoffline+0xc8/0x118 [<000000032a61e048>] onlinestore+0x60/0xe0 [<000000032a08b6b0>] kernfsfopwriteiter+0x150/0x1e8 [<0000000329fab65c>] vfswrite+0x174/0x360 [<0000000329fab9fc>] ksyswrite+0x74/0x100 [<000000032aa03a5a>] _dosyscall+0x1da/0x208 [<000000032aa177b2>] systemcall+0x82/0xb0 INFO: lockdep is turned off. FIX dma-kmalloc-64: Restoring kmalloc Redzone 0x0000000000400564-0x0000000000400567=0xcc FIX dma-kmalloc-64: Object at 0x0000000000400540 not freed
{ "vanir_signatures": [ { "id": "CVE-2023-53108-0a565b1c", "signature_type": "Line", "target": { "file": "net/iucv/iucv.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "282900993962672831640151540001511110591", "10670263073976565115045358385262517122", "23848102933798498291388874563128937968", "284959168834718013130206664722145807128" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3cfdefdaaa4b2a77e84d0db5e0a47a7aa3bb615a" }, { "id": "CVE-2023-53108-2ed2c481", "signature_type": "Line", "target": { "file": "net/iucv/iucv.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "282900993962672831640151540001511110591", "10670263073976565115045358385262517122", "23848102933798498291388874563128937968", "284959168834718013130206664722145807128" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93a970494881004c348d8feb38463ee72496e99a" }, { "id": "CVE-2023-53108-54011446", "signature_type": "Line", "target": { "file": "net/iucv/iucv.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "282900993962672831640151540001511110591", "10670263073976565115045358385262517122", "23848102933798498291388874563128937968", "284959168834718013130206664722145807128" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0d2bb5e31a693ebc8888eb407f8a257a3680efa" }, { "id": "CVE-2023-53108-c896d969", "signature_type": "Line", "target": { "file": "net/iucv/iucv.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "282900993962672831640151540001511110591", "10670263073976565115045358385262517122", "23848102933798498291388874563128937968", "284959168834718013130206664722145807128" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a908eae0f71811afee86be7088692f1aa5855c3b" }, { "id": "CVE-2023-53108-d95986f5", "signature_type": "Line", "target": { "file": "net/iucv/iucv.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "282900993962672831640151540001511110591", "10670263073976565115045358385262517122", "23848102933798498291388874563128937968", "284959168834718013130206664722145807128" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d87debb8ed2649608ff432699e7c961c0c6f03b" }, { "id": "CVE-2023-53108-e28ef2b5", "signature_type": "Line", "target": { "file": "net/iucv/iucv.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "282900993962672831640151540001511110591", "10670263073976565115045358385262517122", "23848102933798498291388874563128937968", "284959168834718013130206664722145807128" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd2e78462ae18484e55ae4d285df2c86b86bdd12" }, { "id": "CVE-2023-53108-f751ed20", "signature_type": "Line", "target": { "file": "net/iucv/iucv.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "282900993962672831640151540001511110591", "10670263073976565115045358385262517122", "23848102933798498291388874563128937968", "284959168834718013130206664722145807128" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@71da5991b6438ad6da13ceb25465ee2760a1c52f" } ] }