In the Linux kernel, the following vulnerability has been resolved:
powerpc/rtas_flash: allow user copy to flash block cache objects
With hardened usercopy enabled (CONFIGHARDENEDUSERCOPY=y), using the /proc/powerpc/rtas/firmware_update interface to prepare a system firmware update yields a BUG():
kernel BUG at mm/usercopy.c:102! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGESIZE=64K MMU=Hash SMP NRCPUS=2048 NUMA pSeries Modules linked in: CPU: 0 PID: 2232 Comm: dd Not tainted 6.5.0-rc3+ #2 Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 of:IBM,FW860.50 (SV860146) hv:phyp pSeries NIP: c0000000005991d0 LR: c0000000005991cc CTR: 0000000000000000 REGS: c0000000148c76a0 TRAP: 0700 Not tainted (6.5.0-rc3+) MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 24002242 XER: 0000000c CFAR: c0000000001fbd34 IRQMASK: 0 [ ... GPRs omitted ... ] NIP usercopyabort+0xa0/0xb0 LR usercopyabort+0x9c/0xb0 Call Trace: usercopyabort+0x9c/0xb0 (unreliable) _checkheapobject+0x1b4/0x1d0 _checkobjectsize+0x2d0/0x380 rtasflashwrite+0xe4/0x250 procregwrite+0xfc/0x160 vfswrite+0xfc/0x4e0 ksyswrite+0x90/0x160 systemcallexception+0x178/0x320 systemcallcommon+0x160/0x2c4
The blocks of the firmware image are copied directly from user memory to objects allocated from flashblockcache, so flashblockcache must be created using kmemcachecreate_usercopy() to mark it safe for user access.
[mpe: Trim and indent oops]
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53487.json"
}[
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "rtas_flash_init",
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"digest": {
"function_hash": "268617501984053384498961634179965837481",
"length": 1197.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f3175979e62de3b929bfa54a0db4b87d36257a7",
"id": "CVE-2023-53487-047d7c4a"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"digest": {
"line_hashes": [
"58760797252552876778335077037759683014",
"211510782481798345914380595457546777430",
"130971937445470541470092737826624619151",
"82304235926472106883339128634892994674",
"225219104075681217562850356397102059340",
"253220867087692279578123575572610765906"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f09cc15dcd91d16562400c51d24c7be0d5796fa",
"id": "CVE-2023-53487-4aa3d499"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "rtas_flash_init",
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"digest": {
"function_hash": "115038505783609235241550054625179717374",
"length": 1200.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d29e21ed09fa668416fa7721e08d451b9903485",
"id": "CVE-2023-53487-60e16fc0"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "rtas_flash_init",
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"digest": {
"function_hash": "115038505783609235241550054625179717374",
"length": 1200.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f09cc15dcd91d16562400c51d24c7be0d5796fa",
"id": "CVE-2023-53487-713c98e4"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"digest": {
"line_hashes": [
"58760797252552876778335077037759683014",
"211510782481798345914380595457546777430",
"130971937445470541470092737826624619151",
"82304235926472106883339128634892994674",
"225219104075681217562850356397102059340",
"253220867087692279578123575572610765906"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ba7f969be599e21d4b1f1e947593de6515f4996",
"id": "CVE-2023-53487-75d36874"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"digest": {
"line_hashes": [
"58760797252552876778335077037759683014",
"211510782481798345914380595457546777430",
"130971937445470541470092737826624619151",
"82304235926472106883339128634892994674",
"225219104075681217562850356397102059340",
"253220867087692279578123575572610765906"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d29e21ed09fa668416fa7721e08d451b9903485",
"id": "CVE-2023-53487-80d8eee8"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"digest": {
"line_hashes": [
"58760797252552876778335077037759683014",
"211510782481798345914380595457546777430",
"130971937445470541470092737826624619151",
"82304235926472106883339128634892994674",
"225219104075681217562850356397102059340",
"253220867087692279578123575572610765906"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8fee83aa4ed3846c7f50a0b364bc699f48d96e5",
"id": "CVE-2023-53487-a4cd42e3"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "rtas_flash_init",
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"digest": {
"function_hash": "6895762666216735710885651959610862195",
"length": 1199.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ef25fb13494e35c6dbe15445c7875fa92bc3e8b",
"id": "CVE-2023-53487-a5404432"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"digest": {
"line_hashes": [
"58760797252552876778335077037759683014",
"211510782481798345914380595457546777430",
"130971937445470541470092737826624619151",
"82304235926472106883339128634892994674",
"225219104075681217562850356397102059340",
"253220867087692279578123575572610765906"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6acb8a453388374fafb3c3b37534b675b2aa0ae1",
"id": "CVE-2023-53487-a6942996"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "rtas_flash_init",
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"digest": {
"function_hash": "6895762666216735710885651959610862195",
"length": 1199.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b8fee83aa4ed3846c7f50a0b364bc699f48d96e5",
"id": "CVE-2023-53487-afae18cb"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"digest": {
"line_hashes": [
"58760797252552876778335077037759683014",
"211510782481798345914380595457546777430",
"130971937445470541470092737826624619151",
"82304235926472106883339128634892994674",
"225219104075681217562850356397102059340",
"253220867087692279578123575572610765906"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ef25fb13494e35c6dbe15445c7875fa92bc3e8b",
"id": "CVE-2023-53487-b145283a"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"digest": {
"line_hashes": [
"58760797252552876778335077037759683014",
"211510782481798345914380595457546777430",
"130971937445470541470092737826624619151",
"82304235926472106883339128634892994674",
"225219104075681217562850356397102059340",
"253220867087692279578123575572610765906"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f3175979e62de3b929bfa54a0db4b87d36257a7",
"id": "CVE-2023-53487-b3b75de4"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "rtas_flash_init",
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"digest": {
"function_hash": "6895762666216735710885651959610862195",
"length": 1199.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ba7f969be599e21d4b1f1e947593de6515f4996",
"id": "CVE-2023-53487-dbe530bb"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "rtas_flash_init",
"file": "arch/powerpc/kernel/rtas_flash.c"
},
"digest": {
"function_hash": "268617501984053384498961634179965837481",
"length": 1197.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6acb8a453388374fafb3c3b37534b675b2aa0ae1",
"id": "CVE-2023-53487-dbf1ef3f"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53487.json"