In the Linux kernel, the following vulnerability has been resolved:
riscv: Use READONCENOCHECK in imprecise unwinding stack mode
When CONFIGFRAMEPOINTER is unset, the stack unwinding function walk_stackframe randomly reads the stack and then, when KASAN is enabled, it can lead to the following backtrace:
[ 0.000000] ================================================================== [ 0.000000] BUG: KASAN: stack-out-of-bounds in walkstackframe+0xa6/0x11a [ 0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0 [ 0.000000] [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43 [ 0.000000] Hardware name: riscv-virtio,qemu (DT) [ 0.000000] Call Trace: [ 0.000000] [<ffffffff80007ba8>] walkstackframe+0x0/0x11a [ 0.000000] [<ffffffff80099ecc>] initparamlock+0x26/0x2a [ 0.000000] [<ffffffff80007c4a>] walkstackframe+0xa2/0x11a [ 0.000000] [<ffffffff80c49c80>] dumpstacklvl+0x22/0x36 [ 0.000000] [<ffffffff80c3783e>] printreport+0x198/0x4a8 [ 0.000000] [<ffffffff80099ecc>] initparamlock+0x26/0x2a [ 0.000000] [<ffffffff80007c4a>] walkstackframe+0xa2/0x11a [ 0.000000] [<ffffffff8015f68a>] kasanreport+0x9a/0xc8 [ 0.000000] [<ffffffff80007c4a>] walkstackframe+0xa2/0x11a [ 0.000000] [<ffffffff80007c4a>] walkstackframe+0xa2/0x11a [ 0.000000] [<ffffffff8006e99c>] descmakefinal+0x80/0x84 [ 0.000000] [<ffffffff8009a04e>] stacktracesave+0x88/0xa6 [ 0.000000] [<ffffffff80099fc2>] filterirqstacks+0x72/0x76 [ 0.000000] [<ffffffff8006b95e>] devkmsgread+0x32a/0x32e [ 0.000000] [<ffffffff8015ec16>] kasansavestack+0x28/0x52 [ 0.000000] [<ffffffff8006e998>] descmakefinal+0x7c/0x84 [ 0.000000] [<ffffffff8009a04a>] stacktracesave+0x84/0xa6 [ 0.000000] [<ffffffff8015ec52>] kasansettrack+0x12/0x20 [ 0.000000] [<ffffffff8015f22e>] kasanslaballoc+0x58/0x5e [ 0.000000] [<ffffffff8015e7ea>] _kmemcachecreate+0x21e/0x39a [ 0.000000] [<ffffffff80e133ac>] createbootcache+0x70/0x9c [ 0.000000] [<ffffffff80e17ab2>] kmemcacheinit+0x6c/0x11e [ 0.000000] [<ffffffff80e00fd6>] mminit+0xd8/0xfe [ 0.000000] [<ffffffff80e011d8>] startkernel+0x190/0x3ca [ 0.000000] [ 0.000000] The buggy address belongs to stack of task swapper/0 [ 0.000000] and is located at offset 0 in frame: [ 0.000000] stacktracesave+0x0/0xa6 [ 0.000000] [ 0.000000] This frame has 1 object: [ 0.000000] [32, 56) 'c' [ 0.000000] [ 0.000000] The buggy address belongs to the physical page: [ 0.000000] page:(ptrval__) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x81a07 [ 0.000000] flags: 0x1000(reserved|zone=0) [ 0.000000] raw: 0000000000001000 ff600003f1e3d150 ff600003f1e3d150 0000000000000000 [ 0.000000] raw: 0000000000000000 0000000000000000 00000001ffffffff [ 0.000000] page dumped because: kasan: bad access detected [ 0.000000] [ 0.000000] Memory state around the buggy address: [ 0.000000] ffffffff81807b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ffffffff81807b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] >ffffffff81807c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3 [ 0.000000] ^ [ 0.000000] ffffffff81807c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ffffffff81807d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ==================================================================
Fix that by using READONCENOCHECK when reading the stack in imprecise mode.
[
{
"id": "CVE-2023-53135-2ca9a942",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "arch/riscv/kernel/stacktrace.c"
},
"digest": {
"line_hashes": [
"134067544593811061684476469840347670321",
"209828084931515427356054108409186040948",
"329762720524195254870691636010752769771",
"186071664731914770669379759990119309672"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@324912d6c0c4006711054d389faa2239c1655e1e"
},
{
"id": "CVE-2023-53135-34de24fc",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "arch/riscv/kernel/stacktrace.c"
},
"digest": {
"line_hashes": [
"325881280453271102218531710860531328204",
"98138165042575638890388544250301848541",
"329762720524195254870691636010752769771",
"186071664731914770669379759990119309672"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3de277af481ab931fab9e295ad8762692920732a"
},
{
"id": "CVE-2023-53135-492c9587",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "arch/riscv/kernel/stacktrace.c",
"function": "walk_stackframe"
},
"digest": {
"function_hash": "126467448088523890184997892014410823125",
"length": 664.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a99a61d9e1bfca2fc37d223a6a185c0eb66aba02"
},
{
"id": "CVE-2023-53135-4cea5dd5",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "arch/riscv/kernel/stacktrace.c"
},
"digest": {
"line_hashes": [
"134067544593811061684476469840347670321",
"209828084931515427356054108409186040948",
"329762720524195254870691636010752769771",
"186071664731914770669379759990119309672"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76950340cf03b149412fe0d5f0810e52ac1df8cb"
},
{
"id": "CVE-2023-53135-4fd92260",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "arch/riscv/kernel/stacktrace.c"
},
"digest": {
"line_hashes": [
"134067544593811061684476469840347670321",
"209828084931515427356054108409186040948",
"329762720524195254870691636010752769771",
"186071664731914770669379759990119309672"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17fa90ffba20743c946920fbb0afe160d0ead8c9"
},
{
"id": "CVE-2023-53135-5768fd28",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "arch/riscv/kernel/stacktrace.c",
"function": "walk_stackframe"
},
"digest": {
"function_hash": "260967393186967511203854655325280907138",
"length": 632.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@324912d6c0c4006711054d389faa2239c1655e1e"
},
{
"id": "CVE-2023-53135-9e6c9e41",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "arch/riscv/kernel/stacktrace.c",
"function": "walk_stackframe"
},
"digest": {
"function_hash": "260967393186967511203854655325280907138",
"length": 632.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17fa90ffba20743c946920fbb0afe160d0ead8c9"
},
{
"id": "CVE-2023-53135-b127c60c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "arch/riscv/kernel/stacktrace.c",
"function": "walk_stackframe"
},
"digest": {
"function_hash": "256856582803761588456044375625387392303",
"length": 621.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3de277af481ab931fab9e295ad8762692920732a"
},
{
"id": "CVE-2023-53135-bba3fe75",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "arch/riscv/kernel/stacktrace.c",
"function": "walk_stackframe"
},
"digest": {
"function_hash": "260967393186967511203854655325280907138",
"length": 632.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76950340cf03b149412fe0d5f0810e52ac1df8cb"
},
{
"id": "CVE-2023-53135-bc0c1d6c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "arch/riscv/kernel/stacktrace.c",
"function": "walk_stackframe"
},
"digest": {
"function_hash": "219490997322348519463571290645964672210",
"length": 623.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a9418d2c93c1c86ce4d0595112d91c7a8e70c2c"
},
{
"id": "CVE-2023-53135-bf53a227",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "arch/riscv/kernel/stacktrace.c"
},
"digest": {
"line_hashes": [
"325881280453271102218531710860531328204",
"98138165042575638890388544250301848541",
"329762720524195254870691636010752769771",
"186071664731914770669379759990119309672"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a99a61d9e1bfca2fc37d223a6a185c0eb66aba02"
},
{
"id": "CVE-2023-53135-df01220b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "arch/riscv/kernel/stacktrace.c"
},
"digest": {
"line_hashes": [
"134067544593811061684476469840347670321",
"209828084931515427356054108409186040948",
"329762720524195254870691636010752769771",
"186071664731914770669379759990119309672"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a9418d2c93c1c86ce4d0595112d91c7a8e70c2c"
}
]