In the Linux kernel, the following vulnerability has been resolved:
powerpc/rtas_flash: allow user copy to flash block cache objects
With hardened usercopy enabled (CONFIGHARDENEDUSERCOPY=y), using the /proc/powerpc/rtas/firmware_update interface to prepare a system firmware update yields a BUG():
kernel BUG at mm/usercopy.c:102! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGESIZE=64K MMU=Hash SMP NRCPUS=2048 NUMA pSeries Modules linked in: CPU: 0 PID: 2232 Comm: dd Not tainted 6.5.0-rc3+ #2 Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 of:IBM,FW860.50 (SV860146) hv:phyp pSeries NIP: c0000000005991d0 LR: c0000000005991cc CTR: 0000000000000000 REGS: c0000000148c76a0 TRAP: 0700 Not tainted (6.5.0-rc3+) MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 24002242 XER: 0000000c CFAR: c0000000001fbd34 IRQMASK: 0 [ ... GPRs omitted ... ] NIP usercopyabort+0xa0/0xb0 LR usercopyabort+0x9c/0xb0 Call Trace: usercopyabort+0x9c/0xb0 (unreliable) _checkheapobject+0x1b4/0x1d0 _checkobjectsize+0x2d0/0x380 rtasflashwrite+0xe4/0x250 procregwrite+0xfc/0x160 vfswrite+0xfc/0x4e0 ksyswrite+0x90/0x160 systemcallexception+0x178/0x320 systemcallcommon+0x160/0x2c4
The blocks of the firmware image are copied directly from user memory to objects allocated from flashblockcache, so flashblockcache must be created using kmemcachecreate_usercopy() to mark it safe for user access.
[mpe: Trim and indent oops]
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53487.json"
}[
{
"digest": {
"length": 1197.0,
"function_hash": "268617501984053384498961634179965837481"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f3175979e62de3b929bfa54a0db4b87d36257a7",
"deprecated": false,
"id": "CVE-2023-53487-047d7c4a",
"signature_type": "Function",
"target": {
"function": "rtas_flash_init",
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"58760797252552876778335077037759683014",
"211510782481798345914380595457546777430",
"130971937445470541470092737826624619151",
"82304235926472106883339128634892994674",
"225219104075681217562850356397102059340",
"253220867087692279578123575572610765906"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f09cc15dcd91d16562400c51d24c7be0d5796fa",
"deprecated": false,
"id": "CVE-2023-53487-4aa3d499",
"signature_type": "Line",
"target": {
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 1200.0,
"function_hash": "115038505783609235241550054625179717374"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d29e21ed09fa668416fa7721e08d451b9903485",
"deprecated": false,
"id": "CVE-2023-53487-60e16fc0",
"signature_type": "Function",
"target": {
"function": "rtas_flash_init",
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 1200.0,
"function_hash": "115038505783609235241550054625179717374"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f09cc15dcd91d16562400c51d24c7be0d5796fa",
"deprecated": false,
"id": "CVE-2023-53487-713c98e4",
"signature_type": "Function",
"target": {
"function": "rtas_flash_init",
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"58760797252552876778335077037759683014",
"211510782481798345914380595457546777430",
"130971937445470541470092737826624619151",
"82304235926472106883339128634892994674",
"225219104075681217562850356397102059340",
"253220867087692279578123575572610765906"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ba7f969be599e21d4b1f1e947593de6515f4996",
"deprecated": false,
"id": "CVE-2023-53487-75d36874",
"signature_type": "Line",
"target": {
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"58760797252552876778335077037759683014",
"211510782481798345914380595457546777430",
"130971937445470541470092737826624619151",
"82304235926472106883339128634892994674",
"225219104075681217562850356397102059340",
"253220867087692279578123575572610765906"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d29e21ed09fa668416fa7721e08d451b9903485",
"deprecated": false,
"id": "CVE-2023-53487-80d8eee8",
"signature_type": "Line",
"target": {
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"58760797252552876778335077037759683014",
"211510782481798345914380595457546777430",
"130971937445470541470092737826624619151",
"82304235926472106883339128634892994674",
"225219104075681217562850356397102059340",
"253220867087692279578123575572610765906"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8fee83aa4ed3846c7f50a0b364bc699f48d96e5",
"deprecated": false,
"id": "CVE-2023-53487-a4cd42e3",
"signature_type": "Line",
"target": {
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 1199.0,
"function_hash": "6895762666216735710885651959610862195"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ef25fb13494e35c6dbe15445c7875fa92bc3e8b",
"deprecated": false,
"id": "CVE-2023-53487-a5404432",
"signature_type": "Function",
"target": {
"function": "rtas_flash_init",
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 1199.0,
"function_hash": "6895762666216735710885651959610862195"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8fee83aa4ed3846c7f50a0b364bc699f48d96e5",
"deprecated": false,
"id": "CVE-2023-53487-afae18cb",
"signature_type": "Function",
"target": {
"function": "rtas_flash_init",
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"58760797252552876778335077037759683014",
"211510782481798345914380595457546777430",
"130971937445470541470092737826624619151",
"82304235926472106883339128634892994674",
"225219104075681217562850356397102059340",
"253220867087692279578123575572610765906"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ef25fb13494e35c6dbe15445c7875fa92bc3e8b",
"deprecated": false,
"id": "CVE-2023-53487-b145283a",
"signature_type": "Line",
"target": {
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"58760797252552876778335077037759683014",
"211510782481798345914380595457546777430",
"130971937445470541470092737826624619151",
"82304235926472106883339128634892994674",
"225219104075681217562850356397102059340",
"253220867087692279578123575572610765906"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f3175979e62de3b929bfa54a0db4b87d36257a7",
"deprecated": false,
"id": "CVE-2023-53487-b3b75de4",
"signature_type": "Line",
"target": {
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 1199.0,
"function_hash": "6895762666216735710885651959610862195"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ba7f969be599e21d4b1f1e947593de6515f4996",
"deprecated": false,
"id": "CVE-2023-53487-dbe530bb",
"signature_type": "Function",
"target": {
"function": "rtas_flash_init",
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"signature_version": "v1"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53487.json"