In the Linux kernel, the following vulnerability has been resolved:
Drivers: vmbus: Check for channel allocation before looking up relids
relid2channel() assumes vmbus channel array to be allocated when called. However, in cases such as kdump/kexec, not all relids will be reset by the host. When the second kernel boots and if the guest receives a vmbus interrupt during vmbus driver initialization before vmbus_connect() is called, before it finishes, or if it fails, the vmbus interrupt service routine is called which in turn calls relid2channel() and can cause a null pointer dereference.
Print a warning and error out in relid2channel() for a channel id that's invalid in the second kernel.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53273.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53273.json"
[
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c3f0ae5435fd20bb1e3a8308488aa6ac33151ee",
"digest": {
"function_hash": "210552234224027066638849369391283791568",
"length": 158.0
},
"id": "CVE-2023-53273-29566638",
"deprecated": false,
"target": {
"file": "drivers/hv/connection.c",
"function": "relid2channel"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a5c44f3446a0565139b7d8abc78f58b86c398123",
"digest": {
"line_hashes": [
"251744618319257936359925382728600109500",
"113986733901260201402296497538655759469",
"292091038183517717286614187759118551705",
"281400945385780559104277422632389632252"
],
"threshold": 0.9
},
"id": "CVE-2023-53273-80c9a133",
"deprecated": false,
"target": {
"file": "drivers/hv/connection.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@176c6b4889195fbe7016d9401175b48c5c9edf68",
"digest": {
"line_hashes": [
"251744618319257936359925382728600109500",
"113986733901260201402296497538655759469",
"292091038183517717286614187759118551705",
"281400945385780559104277422632389632252"
],
"threshold": 0.9
},
"id": "CVE-2023-53273-83fa7028",
"deprecated": false,
"target": {
"file": "drivers/hv/connection.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a5c44f3446a0565139b7d8abc78f58b86c398123",
"digest": {
"function_hash": "210552234224027066638849369391283791568",
"length": 158.0
},
"id": "CVE-2023-53273-c990a5ee",
"deprecated": false,
"target": {
"file": "drivers/hv/connection.c",
"function": "relid2channel"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@176c6b4889195fbe7016d9401175b48c5c9edf68",
"digest": {
"function_hash": "210552234224027066638849369391283791568",
"length": 158.0
},
"id": "CVE-2023-53273-dbe17493",
"deprecated": false,
"target": {
"file": "drivers/hv/connection.c",
"function": "relid2channel"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c3f0ae5435fd20bb1e3a8308488aa6ac33151ee",
"digest": {
"line_hashes": [
"251744618319257936359925382728600109500",
"113986733901260201402296497538655759469",
"292091038183517717286614187759118551705",
"281400945385780559104277422632389632252"
],
"threshold": 0.9
},
"id": "CVE-2023-53273-e33fb007",
"deprecated": false,
"target": {
"file": "drivers/hv/connection.c"
}
}
]