In the Linux kernel, the following vulnerability has been resolved:
pstore/ram: Check start of empty przs during init
After commit 30696378f68a ("pstore/ram: Do not treat empty buffers as valid"), initialization would assume a prz was valid after seeing that the buffer_size is zero (regardless of the buffer start position). This unchecked start value means it could be outside the bounds of the buffer, leading to future access panics when written to:
sysdumppanicevent+0x3b4/0x5b8 atomicnotifiercallchain+0x54/0x90 panic+0x1c8/0x42c die+0x29c/0x2a8 diekernelfault+0x68/0x78 _dokernelfault+0x1c4/0x1e0 dobadarea+0x40/0x100 dotranslationfault+0x68/0x80 domemabort+0x68/0xf8 el1da+0x1c/0xc0 _rawwriteb+0x38/0x174 _memcpytoio+0x40/0xac persistentramupdate+0x44/0x12c persistentramwrite+0x1a8/0x1b8 ramoopspstorewrite+0x198/0x1e8 pstoreconsole_write+0x94/0xe0 ...
To avoid this, also check if the prz start is 0 during the initialization phase. If not, the next prz sanity check case will discover it (start > size) and zap the buffer back to a sane state.
[kees: update commit log with backtrace and clarifications]
[
{
"deprecated": false,
"id": "CVE-2023-53331-030e8250",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e95d7a8a6edd14f8fab44c777dd7281db91f6ae2",
"digest": {
"function_hash": "165409581933380723175237286451147074127",
"length": 959.0
},
"target": {
"function": "persistent_ram_post_init",
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53331-04e0342a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e972231db29b5d1dccc13bf9d5ba55b6979a69ed",
"digest": {
"threshold": 0.9,
"line_hashes": [
"117087880869349847545395346209415029092",
"167294928448354661591683361649734834704",
"104552819715705171777372591558608428371",
"14275449664896424316832628367102761797"
]
},
"target": {
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53331-13876095",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c807ccdd812d18985860504b503899f3140a9549",
"digest": {
"function_hash": "78073155498096528727401306726179563187",
"length": 819.0
},
"target": {
"function": "persistent_ram_post_init",
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53331-14683a18",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fedecaeef88899d940b69368c996e8b3b0b8650d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"117087880869349847545395346209415029092",
"167294928448354661591683361649734834704",
"104552819715705171777372591558608428371",
"14275449664896424316832628367102761797"
]
},
"target": {
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53331-23e1e887",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f77990358628b01bdc03752126ff5f716ea37615",
"digest": {
"threshold": 0.9,
"line_hashes": [
"117087880869349847545395346209415029092",
"167294928448354661591683361649734834704",
"104552819715705171777372591558608428371",
"14275449664896424316832628367102761797"
]
},
"target": {
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53331-3753733d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e972231db29b5d1dccc13bf9d5ba55b6979a69ed",
"digest": {
"function_hash": "165409581933380723175237286451147074127",
"length": 959.0
},
"target": {
"function": "persistent_ram_post_init",
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53331-37e8d16d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f77990358628b01bdc03752126ff5f716ea37615",
"digest": {
"function_hash": "165409581933380723175237286451147074127",
"length": 959.0
},
"target": {
"function": "persistent_ram_post_init",
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53331-43bbd0fa",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89312657337e6e03ad6e9ea1a462bd9c158c85c8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"84873461344237466946358295302023627855",
"167294928448354661591683361649734834704",
"104552819715705171777372591558608428371",
"14275449664896424316832628367102761797"
]
},
"target": {
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53331-4e478cb7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25fb4e3402d46f425ec135ef6f09792a4c1b3003",
"digest": {
"threshold": 0.9,
"line_hashes": [
"117087880869349847545395346209415029092",
"167294928448354661591683361649734834704",
"104552819715705171777372591558608428371",
"14275449664896424316832628367102761797"
]
},
"target": {
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53331-5e2fa651",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fedecaeef88899d940b69368c996e8b3b0b8650d",
"digest": {
"function_hash": "165409581933380723175237286451147074127",
"length": 959.0
},
"target": {
"function": "persistent_ram_post_init",
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53331-62710ca7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe8c3623ab06603eb760444a032d426542212021",
"digest": {
"threshold": 0.9,
"line_hashes": [
"117087880869349847545395346209415029092",
"167294928448354661591683361649734834704",
"104552819715705171777372591558608428371",
"14275449664896424316832628367102761797"
]
},
"target": {
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53331-682c7ba3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c807ccdd812d18985860504b503899f3140a9549",
"digest": {
"threshold": 0.9,
"line_hashes": [
"84873461344237466946358295302023627855",
"167294928448354661591683361649734834704",
"104552819715705171777372591558608428371",
"14275449664896424316832628367102761797"
]
},
"target": {
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53331-7f5fd9cd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe8c3623ab06603eb760444a032d426542212021",
"digest": {
"function_hash": "165409581933380723175237286451147074127",
"length": 959.0
},
"target": {
"function": "persistent_ram_post_init",
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53331-94d408f7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e95d7a8a6edd14f8fab44c777dd7281db91f6ae2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"117087880869349847545395346209415029092",
"167294928448354661591683361649734834704",
"104552819715705171777372591558608428371",
"14275449664896424316832628367102761797"
]
},
"target": {
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53331-c955df4a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc2f60de9a7d3efd982440117dab5579898d808c",
"digest": {
"function_hash": "165409581933380723175237286451147074127",
"length": 959.0
},
"target": {
"function": "persistent_ram_post_init",
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53331-d5d07210",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc2f60de9a7d3efd982440117dab5579898d808c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"117087880869349847545395346209415029092",
"167294928448354661591683361649734834704",
"104552819715705171777372591558608428371",
"14275449664896424316832628367102761797"
]
},
"target": {
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53331-ef3b40a4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89312657337e6e03ad6e9ea1a462bd9c158c85c8",
"digest": {
"function_hash": "78073155498096528727401306726179563187",
"length": 819.0
},
"target": {
"function": "persistent_ram_post_init",
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53331-fd5d9be5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25fb4e3402d46f425ec135ef6f09792a4c1b3003",
"digest": {
"function_hash": "165409581933380723175237286451147074127",
"length": 959.0
},
"target": {
"function": "persistent_ram_post_init",
"file": "fs/pstore/ram_core.c"
},
"signature_type": "Function",
"signature_version": "v1"
}
]