CVE-2023-52614: PM / devfreq: Fix buffer overflow in trans_stat_show
In the Linux kernel, the following vulnerability has been resolved:
PM / devfreq: Fix buffer overflow in transstatshow
Fix buffer overflow in transstatshow().
Convert simple snprintf to the more secure scnprintf with size of PAGESIZE.
Add condition checking if we are exceeding PAGESIZE and exit early from loop. Also add at the end a warning that we exceeded PAGESIZE and that stats is disabled.
Return -EFBIG in the case where we don't have enough space to write the full transition table.
Also document in the ABI that this function can return -EFBIG error.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
PM / devfreq: Fix buffer overflow in transstatshow
The Linux kernel CVE team has assigned CVE-2023-52614 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/20240318101458.2835626-9-lee@kernel.org/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.149 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.76 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.15 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.3 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2023-52614 - Configuration
In trans_stat_show(), add condition checking if output would exceed PAGE_SIZE; if it does, exit early from the loop. At the end of the function, emit a warning stating that PAGE_SIZE was exceeded and that stats is disabled.
Linux kernel (PM / devfreq) trans_stat_show() stats behavior when exceeding PAGE_SIZE = disabled - Configuration
Convert the relevant simple snprintf call(s) in trans_stat_show() to scnprintf, using PAGE_SIZE as the size argument.
Linux kernel (PM / devfreq) trans_stat_show() scnprintf usage = use scnprintf with size PAGE_SIZE - Configuration
Update trans_stat_show() to return -EFBIG when there is not enough space to write the full transition table (including when size would exceed PAGE_SIZE). Also document in the ABI that this function can return -EFBIG.
Linux kernel (PM / devfreq) trans_stat_show() return value on insufficient buffer space = -EFBIG - Compensating control
Ensure any devfreq transition table output paths are bounded by PAGE_SIZE and avoid writing beyond the buffer; exit early from the loop when PAGE_SIZE would be exceeded to prevent buffer overflow.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52614?
CVE-2023-52614 has been classified as a medium severity vulnerability due to the potential risk of buffer overflow.
How do I fix CVE-2023-52614?
To fix CVE-2023-52614, update the Linux kernel to version 5.15.149 or later, or apply the relevant patches if using Debian packages.
What systems are affected by CVE-2023-52614?
CVE-2023-52614 affects various versions of the Linux kernel, particularly those before 5.15.149, 6.1.76, and 6.6.15.
Is CVE-2023-52614 being actively exploited?
As of now, there are no public reports suggesting that CVE-2023-52614 is actively being exploited in the wild.
What are the potential impacts of CVE-2023-52614 if not patched?
If not patched, CVE-2023-52614 could lead to application crashes or potential privilege escalation due to the buffer overflow vulnerability.