An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-46813.json"
[
{
"id": "CVE-2023-46813-1380eae3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@b9cb9c45583b911e0db71d09caa6b56469eb2bdf",
"target": {
"file": "arch/x86/kernel/sev-shared.c",
"function": "vc_ioio_exitinfo"
},
"digest": {
"function_hash": "262022198994832573917196084652026944318",
"length": 1353.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-46813-417650b1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@b9cb9c45583b911e0db71d09caa6b56469eb2bdf",
"target": {
"file": "arch/x86/kernel/sev-shared.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"192751625003045302245832050133030219995",
"94761727908443263741222345827870955908",
"137372131353565414981526057535532747216",
"148540003692320986024313011213228145097",
"127841164380687360055434954458818107826",
"335489741683614571847700160137895384279",
"280274857408844113673315993159101108269",
"302785757367570710237421845359558606557",
"177921907105610408260699046795498758768",
"56256313127184963710481345419976913329",
"98350103482148209367776413420992506202",
"90185121384778689616021738895806408250",
"7146636164427046810738675929516691524",
"228624682389309354581610927475085954593",
"14547942838659038115899674689506435581",
"98227036395192114900153926456644198129",
"83589124146787998695092922507467328601",
"168500476806588742596945876622223634857",
"190804899912363441355469402117875452595",
"211372918641412607716089580718579514733",
"114544577739664203238056565477204121524",
"241545672577260289990859911620458332285",
"163851493054401359352586838293150923423",
"33307750892756170707213500898980886837",
"128124610820050404748676077500415358570",
"255268265352624403317261523287815785504",
"339861688706194776469669169613511221492",
"156122177165110628181747312953206911191",
"259326479277433932638098978822642928741",
"336404199965511520476530089579903149979",
"284777462036580424454425597310811434327",
"208241989993123926529111779600491203057",
"177059114908482700244966599559372683600",
"272350419029913793287576685134027052787",
"255787146490408211220016005383544503819",
"169369729163693544027666625876353974323",
"327451387574218438112670087210545254043",
"190692266184498618554176898069423553307",
"23158600639481542217556384893967724702",
"317085157420104140190993177840195213716",
"180756820371065905759199618733627840592",
"58116873080579035944757175943731302777",
"50531061009784107351688886231889280735",
"287129838018866446069499040361878578659",
"102814921828380133554887543343728001790",
"204930252703179575156065130200237363478",
"247135462280974102133326763424968982350",
"37247639009519282276849638975634165512",
"33009645444930666071615345272863134262"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2023-46813-5058216d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@63e44bc52047f182601e7817da969a105aa1f721",
"target": {
"file": "arch/x86/boot/compressed/sev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"208529997097969538288717598585630361384",
"277963186767840490595517068384447330649",
"297720348593327196004791354030445787137"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2023-46813-8685845a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a37cd2a59d0cb270b1bba568fd3a3b8668b9d3ba",
"target": {
"file": "arch/x86/kernel/sev.c",
"function": "vc_handle_mmio"
},
"digest": {
"function_hash": "46093564634554611181041130405654699395",
"length": 1617.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-46813-8beb0514",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@b9cb9c45583b911e0db71d09caa6b56469eb2bdf",
"target": {
"file": "arch/x86/boot/compressed/sev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"66654859086552398184841389973670887380",
"277963186767840490595517068384447330649",
"297720348593327196004791354030445787137"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2023-46813-a82150b2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@63e44bc52047f182601e7817da969a105aa1f721",
"target": {
"file": "arch/x86/kernel/sev-shared.c",
"function": "vc_insn_string_write"
},
"digest": {
"function_hash": "321303369496713257196944558978073996074",
"length": 408.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-46813-d71a5a80",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@63e44bc52047f182601e7817da969a105aa1f721",
"target": {
"file": "arch/x86/kernel/sev-shared.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"168451549007418118867585342007967901909",
"46979326088450639791712250210643785003",
"269305483139768805778572744408269516086",
"241496472935639750564657700608915350964",
"29177986700347308130505729480983478513",
"29183334497972614409749713410636182128",
"329876746557994333449397042094443509416",
"240042600777903818057349636347067874439",
"30324024839644793870256387209437605287",
"290359001802070231895531772442524596676",
"147170196472609121764973751329978169377"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2023-46813-dcfac2d6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a37cd2a59d0cb270b1bba568fd3a3b8668b9d3ba",
"target": {
"file": "arch/x86/kernel/sev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"53572486059806742550136646480687262760",
"122058277260639109647932226970182261347",
"152793675457363570525869413874719243065"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2023-46813-fda24a0c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@63e44bc52047f182601e7817da969a105aa1f721",
"target": {
"file": "arch/x86/kernel/sev-shared.c",
"function": "vc_insn_string_read"
},
"digest": {
"function_hash": "321303369496713257196944558978073996074",
"length": 408.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
}
]