CVE-2023-52639: KVM: s390: vsie: fix race during shadow creation
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: vsie: fix race during shadow creation
Right now it is possible to see gmap->private being zero in kvms390vsiegmapnotifier resulting in a crash. This is due to the fact that we add gmap->private == kvm after creation:
static int acquiregmapshadow(struct kvmvcpu vcpu, struct vsiepage vsiepage) { [...] gmap = gmapshadow(vcpu->arch.gmap, asce, edat); if (ISERR(gmap)) return PTRERR(gmap); gmap->private = vcpu->kvm;
Let children inherit the private field of the parent.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: vsie: fix race during shadow creation
The Linux kernel CVE team has assigned CVE-2023-52639 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040335-CVE-2023-52639-5b67@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.82 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.22 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52639?
CVE-2023-52639 has a high severity due to its potential to cause crashes in the Linux kernel.
How do I fix CVE-2023-52639?
To fix CVE-2023-52639, update the kernel to version 6.1.82 or higher from Red Hat or install the patched versions 6.1.123-1, 6.1.128-1, or 6.12.12-1 from Debian.
Which versions of the Linux kernel are affected by CVE-2023-52639?
CVE-2023-52639 affects various versions of the Linux kernel prior to 6.1.82 and several others as listed.
Is CVE-2023-52639 specific to a particular platform?
Yes, CVE-2023-52639 specifically affects the KVM component of the Linux kernel on s390 platforms.
What are the potential consequences of not addressing CVE-2023-52639?
Failing to address CVE-2023-52639 may result in system instability and crashes during shadow creation in KVM environments.