In the Linux kernel, the following vulnerability has been resolved:
Drivers: vmbus: Check for channel allocation before looking up relids
relid2channel() assumes vmbus channel array to be allocated when called. However, in cases such as kdump/kexec, not all relids will be reset by the host. When the second kernel boots and if the guest receives a vmbus interrupt during vmbus driver initialization before vmbus_connect() is called, before it finishes, or if it fails, the vmbus interrupt service routine is called which in turn calls relid2channel() and can cause a null pointer dereference.
Print a warning and error out in relid2channel() for a channel id that's invalid in the second kernel.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c3f0ae5435fd20bb1e3a8308488aa6ac33151ee",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53273-29566638",
"target": {
"function": "relid2channel",
"file": "drivers/hv/connection.c"
},
"digest": {
"length": 158.0,
"function_hash": "210552234224027066638849369391283791568"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c373e49fbb87aa177819866ed9194ebc5414dfd6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53273-3d81bc42",
"target": {
"file": "drivers/hv/connection.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"251744618319257936359925382728600109500",
"113986733901260201402296497538655759469",
"292091038183517717286614187759118551705",
"281400945385780559104277422632389632252"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a5c44f3446a0565139b7d8abc78f58b86c398123",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53273-80c9a133",
"target": {
"file": "drivers/hv/connection.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"251744618319257936359925382728600109500",
"113986733901260201402296497538655759469",
"292091038183517717286614187759118551705",
"281400945385780559104277422632389632252"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@176c6b4889195fbe7016d9401175b48c5c9edf68",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53273-83fa7028",
"target": {
"file": "drivers/hv/connection.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"251744618319257936359925382728600109500",
"113986733901260201402296497538655759469",
"292091038183517717286614187759118551705",
"281400945385780559104277422632389632252"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1eb65c8687316c65140b48fad27133d583178e15",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53273-997d5931",
"target": {
"file": "drivers/hv/connection.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"251744618319257936359925382728600109500",
"113986733901260201402296497538655759469",
"292091038183517717286614187759118551705",
"281400945385780559104277422632389632252"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a5c44f3446a0565139b7d8abc78f58b86c398123",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53273-c990a5ee",
"target": {
"function": "relid2channel",
"file": "drivers/hv/connection.c"
},
"digest": {
"length": 158.0,
"function_hash": "210552234224027066638849369391283791568"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c373e49fbb87aa177819866ed9194ebc5414dfd6",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53273-cc8f38a5",
"target": {
"function": "relid2channel",
"file": "drivers/hv/connection.c"
},
"digest": {
"length": 158.0,
"function_hash": "210552234224027066638849369391283791568"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@176c6b4889195fbe7016d9401175b48c5c9edf68",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53273-dbe17493",
"target": {
"function": "relid2channel",
"file": "drivers/hv/connection.c"
},
"digest": {
"length": 158.0,
"function_hash": "210552234224027066638849369391283791568"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c3f0ae5435fd20bb1e3a8308488aa6ac33151ee",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53273-e33fb007",
"target": {
"file": "drivers/hv/connection.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"251744618319257936359925382728600109500",
"113986733901260201402296497538655759469",
"292091038183517717286614187759118551705",
"281400945385780559104277422632389632252"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1eb65c8687316c65140b48fad27133d583178e15",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53273-e3e5a266",
"target": {
"function": "relid2channel",
"file": "drivers/hv/connection.c"
},
"digest": {
"length": 158.0,
"function_hash": "210552234224027066638849369391283791568"
},
"signature_type": "Function"
}
]