CVE-2023-52683: ACPI: LPIT: Avoid u32 multiplication overflow
In the Linux kernel, the following vulnerability has been resolved:
ACPI: LPIT: Avoid u32 multiplication overflow
In lpitupdateresidency() there is a possibility of overflow in multiplication, if tsckhz is large enough (> UINTMAX/1000).
Change multiplication to mulu32u32().
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ACPI: LPIT: Avoid u32 multiplication overflow
The Linux kernel CVE team has assigned CVE-2023-52683 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051751-CVE-2023-52683-f280@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.19.306 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.268 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.209 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.148 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.75 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.14 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52683?
CVE-2023-52683 has been rated as a medium severity vulnerability.
How do I fix CVE-2023-52683?
To fix CVE-2023-52683, update the kernel to version 4.19.306, 5.4.268, 5.10.209, 5.15.148, 6.1.75, 6.6.14, 6.7.2, or 6.8 from Red Hat, or to specific versions from Debian as mentioned in the advisory.
What is affected by CVE-2023-52683?
CVE-2023-52683 affects the ACPI implementation within multiple versions of the Linux kernel.
What type of vulnerability is CVE-2023-52683?
CVE-2023-52683 is a vulnerability that involves a potential multiplication overflow in the LPIT ACPI code.
What systems are impacted by CVE-2023-52683?
Systems using the specified vulnerable versions of the Linux kernel are impacted by CVE-2023-52683.