CVE-2023-52576 x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer()

2024-03-0221:59:44

Linux

github.com

linux kernel

vulnerability resolved

x86 architecture

memory management

kexec

ima

use-after-free

memblock

allocator

kasan

kfence

bug

kernel panic

code switch

AI Score

6.7

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

In the Linux kernel, the following vulnerability has been resolved:

x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer()

The code calling ima_free_kexec_buffer() runs long after the memblock
allocator has already been torn down, potentially resulting in a use
after free in memblock_isolate_range().

With KASAN or KFENCE, this use after free will result in a BUG
from the idle task, and a subsequent kernel panic.

Switch ima_free_kexec_buffer() over to memblock_free_late() to avoid
that bug.

CNA Affected

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "fee3ff99bc67",
        "lessThan": "eef16bfdb212",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "fee3ff99bc67",
        "lessThan": "d2dfbc0e3b7a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "fee3ff99bc67",
        "lessThan": "34cf99c250d5",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "arch/x86/kernel/setup.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.13"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.13",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "6.1.56",
        "versionType": "custom",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.5.6",
        "versionType": "custom",
        "lessThanOrEqual": "6.5.*"
      },
      {
        "status": "unaffected",
        "version": "6.6",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "arch/x86/kernel/setup.c"
    ],
    "defaultStatus": "affected"
  }
]