In the Linux kernel, the following vulnerability has been resolved:
um: time-travel: fix time corruption
In 'basic' time-travel mode (without =inf-cpu or =ext), we still get timer interrupts. These can happen at arbitrary points in time, i.e. while in timer_read(), which pushes time forward just a little bit. Then, if we happen to get the interrupt after calculating the new time to push to, but before actually finishing that, the interrupt will set the time to a value that's incompatible with the forward, and we'll crash because time goes backwards when we do the forwarding.
Fix this by reading the timetraveltime, calculating the adjustment, and doing the adjustment all with interrupts disabled.
{ "vanir_signatures": [ { "signature_version": "v1", "digest": { "length": 91.0, "function_hash": "117934482909567910687747987019125961489" }, "id": "CVE-2023-52633-06af0e21", "deprecated": false, "target": { "file": "arch/um/kernel/time.c", "function": "time_travel_ndelay" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c7478a2da3f5fe106b4658338873d50c86ac7ab" }, { "signature_version": "v1", "digest": { "length": 318.0, "function_hash": "6095989636611899555819872713539964570" }, "id": "CVE-2023-52633-0addccc8", "deprecated": false, "target": { "file": "arch/um/kernel/time.c", "function": "timer_read" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de3e9d8e8d1ae0a4d301109d1ec140796901306c" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "265616354708479624281361994069080497147", "218444132027289608607135201002653234781", "40552845135562283952618547476615878810", "220003688708420592292076392472779891205", "81248920705295868817236768193906371728", "107772891942014154384530614731483619979", "201998020752996631990771220453694158019", "4089633523940725231097294324803306545", "5541616529541743102745113079448191643", "237756480133607630917143743249997848939", "308712766241922368208649659597645886553", "265995353929360586858740597016505339905", "259454239740188630707226194176420483762", "186883267453980756422619190364993443485", "129496340840403675186576036001975247438", "280651923646373706108546977179592001377" ] }, "id": "CVE-2023-52633-11f9ff97", "deprecated": false, "target": { "file": "arch/um/kernel/time.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c7478a2da3f5fe106b4658338873d50c86ac7ab" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "265616354708479624281361994069080497147", "218444132027289608607135201002653234781", "40552845135562283952618547476615878810", "220003688708420592292076392472779891205", "81248920705295868817236768193906371728", "107772891942014154384530614731483619979", "201998020752996631990771220453694158019", "4089633523940725231097294324803306545", "5541616529541743102745113079448191643", "237756480133607630917143743249997848939", "308712766241922368208649659597645886553", "265995353929360586858740597016505339905", "259454239740188630707226194176420483762", "186883267453980756422619190364993443485", "129496340840403675186576036001975247438", "280651923646373706108546977179592001377" ] }, "id": "CVE-2023-52633-1962d305", "deprecated": false, "target": { "file": "arch/um/kernel/time.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f7dad73df4cdb2b7042103d3922745d040ad025" }, { "signature_version": "v1", "digest": { "length": 318.0, "function_hash": "6095989636611899555819872713539964570" }, "id": "CVE-2023-52633-7a317519", "deprecated": false, "target": { "file": "arch/um/kernel/time.c", "function": "timer_read" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c7478a2da3f5fe106b4658338873d50c86ac7ab" }, { "signature_version": "v1", "digest": { "length": 91.0, "function_hash": "117934482909567910687747987019125961489" }, "id": "CVE-2023-52633-7d55e540", "deprecated": false, "target": { "file": "arch/um/kernel/time.c", "function": "time_travel_ndelay" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abe4eaa8618bb36c2b33e9cdde0499296a23448c" }, { "signature_version": "v1", "digest": { "length": 91.0, "function_hash": "117934482909567910687747987019125961489" }, "id": "CVE-2023-52633-91f42fb9", "deprecated": false, "target": { "file": "arch/um/kernel/time.c", "function": "time_travel_ndelay" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b427f55e9d4185f6f17cc1e3296eb8d0c4425283" }, { "signature_version": "v1", "digest": { "length": 318.0, "function_hash": "6095989636611899555819872713539964570" }, "id": "CVE-2023-52633-99a2978f", "deprecated": false, "target": { "file": "arch/um/kernel/time.c", "function": "timer_read" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b427f55e9d4185f6f17cc1e3296eb8d0c4425283" }, { "signature_version": "v1", "digest": { "length": 318.0, "function_hash": "6095989636611899555819872713539964570" }, "id": "CVE-2023-52633-9a099efd", "deprecated": false, "target": { "file": "arch/um/kernel/time.c", "function": "timer_read" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abe4eaa8618bb36c2b33e9cdde0499296a23448c" }, { "signature_version": "v1", "digest": { "length": 91.0, "function_hash": "117934482909567910687747987019125961489" }, "id": "CVE-2023-52633-bb61bc58", "deprecated": false, "target": { "file": "arch/um/kernel/time.c", "function": "time_travel_ndelay" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f7dad73df4cdb2b7042103d3922745d040ad025" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "265616354708479624281361994069080497147", "218444132027289608607135201002653234781", "40552845135562283952618547476615878810", "220003688708420592292076392472779891205", "81248920705295868817236768193906371728", "107772891942014154384530614731483619979", "201998020752996631990771220453694158019", "4089633523940725231097294324803306545", "5541616529541743102745113079448191643", "237756480133607630917143743249997848939", "308712766241922368208649659597645886553", "265995353929360586858740597016505339905", "259454239740188630707226194176420483762", "186883267453980756422619190364993443485", "129496340840403675186576036001975247438", "280651923646373706108546977179592001377" ] }, "id": "CVE-2023-52633-bc599464", "deprecated": false, "target": { "file": "arch/um/kernel/time.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b427f55e9d4185f6f17cc1e3296eb8d0c4425283" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "265616354708479624281361994069080497147", "218444132027289608607135201002653234781", "40552845135562283952618547476615878810", "220003688708420592292076392472779891205", "81248920705295868817236768193906371728", "107772891942014154384530614731483619979", "201998020752996631990771220453694158019", "4089633523940725231097294324803306545", "5541616529541743102745113079448191643", "237756480133607630917143743249997848939", "308712766241922368208649659597645886553", "265995353929360586858740597016505339905", "259454239740188630707226194176420483762", "186883267453980756422619190364993443485", "129496340840403675186576036001975247438", "280651923646373706108546977179592001377" ] }, "id": "CVE-2023-52633-c76bf9e5", "deprecated": false, "target": { "file": "arch/um/kernel/time.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abe4eaa8618bb36c2b33e9cdde0499296a23448c" }, { "signature_version": "v1", "digest": { "length": 91.0, "function_hash": "117934482909567910687747987019125961489" }, "id": "CVE-2023-52633-d6f6307f", "deprecated": false, "target": { "file": "arch/um/kernel/time.c", "function": "time_travel_ndelay" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de3e9d8e8d1ae0a4d301109d1ec140796901306c" }, { "signature_version": "v1", "digest": { "threshold": 0.9, "line_hashes": [ "265616354708479624281361994069080497147", "218444132027289608607135201002653234781", "40552845135562283952618547476615878810", "220003688708420592292076392472779891205", "81248920705295868817236768193906371728", "107772891942014154384530614731483619979", "201998020752996631990771220453694158019", "4089633523940725231097294324803306545", "5541616529541743102745113079448191643", "237756480133607630917143743249997848939", "308712766241922368208649659597645886553", "265995353929360586858740597016505339905", "259454239740188630707226194176420483762", "186883267453980756422619190364993443485", "129496340840403675186576036001975247438", "280651923646373706108546977179592001377" ] }, "id": "CVE-2023-52633-f710e747", "deprecated": false, "target": { "file": "arch/um/kernel/time.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de3e9d8e8d1ae0a4d301109d1ec140796901306c" }, { "signature_version": "v1", "digest": { "length": 318.0, "function_hash": "6095989636611899555819872713539964570" }, "id": "CVE-2023-52633-fcee5b0b", "deprecated": false, "target": { "file": "arch/um/kernel/time.c", "function": "timer_read" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f7dad73df4cdb2b7042103d3922745d040ad025" } ] }