CVE-2023-53395: ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Add AMLNOOPERANDRESOLVE flag to Timer
ACPICA commit 90310989a0790032f5a0140741ff09b545af4bc5
According to the ACPI specification 19.6.134, no argument is required to be passed for ASL Timer instruction. For taking care of no argument, AMLNOOPERANDRESOLVE flag is added to ASL Timer instruction opcode.
When ASL timer instruction interpreted by ACPI interpreter, getting error. After adding AMLNOOPERANDRESOLVE flag to ASL Timer instruction opcode, issue is not observed.
============================================================= UBSAN: array-index-out-of-bounds in acpica/dswexec.c:401:12 index -1 is out of range for type 'union acpioperandobject [9]' CPU: 37 PID: 1678 Comm: cat Not tainted 6.0.0-dev-th500-6.0.y-1+bcf8c46459e407-generic-64k HW name: NVIDIA BIOS v1.1.1-d7acbfc-dirty 12/19/2022 Call trace: dumpbacktrace+0xe0/0x130 showstack+0x20/0x60 dumpstacklvl+0x68/0x84 dumpstack+0x18/0x34 ubsanepilogue+0x10/0x50 ubsanhandleoutofbounds+0x80/0x90 acpidsexecendop+0x1bc/0x6d8 acpipsparseloop+0x57c/0x618 acpipsparseaml+0x1e0/0x4b4 acpipsexecutemethod+0x24c/0x2b8 acpinsevaluate+0x3a8/0x4bc acpievaluateobject+0x15c/0x37c acpievaluateinteger+0x54/0x15c showpower+0x8c/0x12c [acpipowermeter]
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53395?
CVE-2023-53395 has not been assigned a severity score, but it addresses a specific flaw within the Linux kernel.
How do I fix CVE-2023-53395?
To fix CVE-2023-53395, update your Linux kernel to the latest version where this vulnerability has been addressed.
What systems are affected by CVE-2023-53395?
CVE-2023-53395 affects the Linux kernel and ACPICA systems that leverage the AML_NO_OPERAND_RESOLVE flag.
What is the nature of the vulnerability in CVE-2023-53395?
CVE-2023-53395 relates to an issue in the Linux kernel where the ASL Timer instruction does not require any operands, which could lead to improper handling.
When was CVE-2023-53395 reported?
CVE-2023-53395 was reported in 2023, with resolutions being implemented in recent Linux kernel updates.