CVE-2023-52978 (GCVE-0-2023-52978)
Vulnerability from cvelistv5
Published
2025-03-27 16:43
Modified
2025-05-04 07:46
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: riscv: kprobe: Fixup kernel panic when probing an illegal position The kernel would panic when probed for an illegal position. eg: (CONFIG_RISCV_ISA_C=n) echo 'p:hello kernel_clone+0x16 a0=%a0' >> kprobe_events echo 1 > events/kprobes/hello/enable cat trace Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: __do_sys_newfstatat+0xb8/0xb8 CPU: 0 PID: 111 Comm: sh Not tainted 6.2.0-rc1-00027-g2d398fe49a4d #490 Hardware name: riscv-virtio,qemu (DT) Call Trace: [<ffffffff80007268>] dump_backtrace+0x38/0x48 [<ffffffff80c5e83c>] show_stack+0x50/0x68 [<ffffffff80c6da28>] dump_stack_lvl+0x60/0x84 [<ffffffff80c6da6c>] dump_stack+0x20/0x30 [<ffffffff80c5ecf4>] panic+0x160/0x374 [<ffffffff80c6db94>] generic_handle_arch_irq+0x0/0xa8 [<ffffffff802deeb0>] sys_newstat+0x0/0x30 [<ffffffff800158c0>] sys_clone+0x20/0x30 [<ffffffff800039e8>] ret_from_syscall+0x0/0x4 ---[ end Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: __do_sys_newfstatat+0xb8/0xb8 ]--- That is because the kprobe's ebreak instruction broke the kernel's original code. The user should guarantee the correction of the probe position, but it couldn't make the kernel panic. This patch adds arch_check_kprobe in arch_prepare_kprobe to prevent an illegal position (Such as the middle of an instruction).
References
Impacted products
Vendor Product Version
Linux Linux Version: c22b0bcb1dd024cb9caad9230e3a387d8b061df5
Version: c22b0bcb1dd024cb9caad9230e3a387d8b061df5
Version: c22b0bcb1dd024cb9caad9230e3a387d8b061df5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/kernel/probes/kprobes.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "04a73558209554da17f46490ec4faaaf1b2bab68",
              "status": "affected",
              "version": "c22b0bcb1dd024cb9caad9230e3a387d8b061df5",
              "versionType": "git"
            },
            {
              "lessThan": "12316538b1d193064109ce1a28fc9bacd43950de",
              "status": "affected",
              "version": "c22b0bcb1dd024cb9caad9230e3a387d8b061df5",
              "versionType": "git"
            },
            {
              "lessThan": "87f48c7ccc73afc78630530d9af51f458f58cab8",
              "status": "affected",
              "version": "c22b0bcb1dd024cb9caad9230e3a387d8b061df5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/kernel/probes/kprobes.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.93",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.11",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: kprobe: Fixup kernel panic when probing an illegal position\n\nThe kernel would panic when probed for an illegal position. eg:\n\n(CONFIG_RISCV_ISA_C=n)\n\necho \u0027p:hello kernel_clone+0x16 a0=%a0\u0027 \u003e\u003e kprobe_events\necho 1 \u003e events/kprobes/hello/enable\ncat trace\n\nKernel panic - not syncing: stack-protector: Kernel stack\nis corrupted in: __do_sys_newfstatat+0xb8/0xb8\nCPU: 0 PID: 111 Comm: sh Not tainted\n6.2.0-rc1-00027-g2d398fe49a4d #490\nHardware name: riscv-virtio,qemu (DT)\nCall Trace:\n[\u003cffffffff80007268\u003e] dump_backtrace+0x38/0x48\n[\u003cffffffff80c5e83c\u003e] show_stack+0x50/0x68\n[\u003cffffffff80c6da28\u003e] dump_stack_lvl+0x60/0x84\n[\u003cffffffff80c6da6c\u003e] dump_stack+0x20/0x30\n[\u003cffffffff80c5ecf4\u003e] panic+0x160/0x374\n[\u003cffffffff80c6db94\u003e] generic_handle_arch_irq+0x0/0xa8\n[\u003cffffffff802deeb0\u003e] sys_newstat+0x0/0x30\n[\u003cffffffff800158c0\u003e] sys_clone+0x20/0x30\n[\u003cffffffff800039e8\u003e] ret_from_syscall+0x0/0x4\n---[ end Kernel panic - not syncing: stack-protector:\nKernel stack is corrupted in: __do_sys_newfstatat+0xb8/0xb8 ]---\n\nThat is because the kprobe\u0027s ebreak instruction broke the kernel\u0027s\noriginal code. The user should guarantee the correction of the probe\nposition, but it couldn\u0027t make the kernel panic.\n\nThis patch adds arch_check_kprobe in arch_prepare_kprobe to prevent an\nillegal position (Such as the middle of an instruction)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:46:42.575Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/04a73558209554da17f46490ec4faaaf1b2bab68"
        },
        {
          "url": "https://git.kernel.org/stable/c/12316538b1d193064109ce1a28fc9bacd43950de"
        },
        {
          "url": "https://git.kernel.org/stable/c/87f48c7ccc73afc78630530d9af51f458f58cab8"
        }
      ],
      "title": "riscv: kprobe: Fixup kernel panic when probing an illegal position",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52978",
    "datePublished": "2025-03-27T16:43:18.185Z",
    "dateReserved": "2025-03-27T16:40:15.738Z",
    "dateUpdated": "2025-05-04T07:46:42.575Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52978\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-03-27T17:15:44.923\",\"lastModified\":\"2025-04-15T14:49:22.897\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nriscv: kprobe: Fixup kernel panic when probing an illegal position\\n\\nThe kernel would panic when probed for an illegal position. eg:\\n\\n(CONFIG_RISCV_ISA_C=n)\\n\\necho \u0027p:hello kernel_clone+0x16 a0=%a0\u0027 \u003e\u003e kprobe_events\\necho 1 \u003e events/kprobes/hello/enable\\ncat trace\\n\\nKernel panic - not syncing: stack-protector: Kernel stack\\nis corrupted in: __do_sys_newfstatat+0xb8/0xb8\\nCPU: 0 PID: 111 Comm: sh Not tainted\\n6.2.0-rc1-00027-g2d398fe49a4d #490\\nHardware name: riscv-virtio,qemu (DT)\\nCall Trace:\\n[\u003cffffffff80007268\u003e] dump_backtrace+0x38/0x48\\n[\u003cffffffff80c5e83c\u003e] show_stack+0x50/0x68\\n[\u003cffffffff80c6da28\u003e] dump_stack_lvl+0x60/0x84\\n[\u003cffffffff80c6da6c\u003e] dump_stack+0x20/0x30\\n[\u003cffffffff80c5ecf4\u003e] panic+0x160/0x374\\n[\u003cffffffff80c6db94\u003e] generic_handle_arch_irq+0x0/0xa8\\n[\u003cffffffff802deeb0\u003e] sys_newstat+0x0/0x30\\n[\u003cffffffff800158c0\u003e] sys_clone+0x20/0x30\\n[\u003cffffffff800039e8\u003e] ret_from_syscall+0x0/0x4\\n---[ end Kernel panic - not syncing: stack-protector:\\nKernel stack is corrupted in: __do_sys_newfstatat+0xb8/0xb8 ]---\\n\\nThat is because the kprobe\u0027s ebreak instruction broke the kernel\u0027s\\noriginal code. The user should guarantee the correction of the probe\\nposition, but it couldn\u0027t make the kernel panic.\\n\\nThis patch adds arch_check_kprobe in arch_prepare_kprobe to prevent an\\nillegal position (Such as the middle of an instruction).\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: riscv: kprobe: Correcci\u00f3n del p\u00e1nico del kernel al sondear una posici\u00f3n ilegal El kernel entrar\u00eda en p\u00e1nico cuando se sondeara una posici\u00f3n ilegal. p. ej.: (CONFIG_RISCV_ISA_C=n) echo \u0027p:hello kernel_clone+0x16 a0=%a0\u0027 \u0026gt;\u0026gt; kprobe_events echo 1 \u0026gt; events/kprobes/hello/enable cat trace Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: __do_sys_newfstatat+0xb8/0xb8 CPU: 0 PID: 111 Comm: sh Not tainted 6.2.0-rc1-00027-g2d398fe49a4d #490 Hardware name: riscv-virtio,qemu (DT) Call Trace: [] dump_backtrace+0x38/0x48 [] show_stack+0x50/0x68 [] dump_stack_lvl+0x60/0x84 [] dump_stack+0x20/0x30 [] panic+0x160/0x374 [] generic_handle_arch_irq+0x0/0xa8 [] sys_newstat+0x0/0x30 [] sys_clone+0x20/0x30 [] ret_from_syscall+0x0/0x4 ---[ end Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: __do_sys_newfstatat+0xb8/0xb8 ]--- Esto se debe a que la instrucci\u00f3n ebreak de kprobe rompi\u00f3 el c\u00f3digo original del n\u00facleo. El usuario deber\u00eda garantizar la correcci\u00f3n de la posici\u00f3n de la sonda, pero no pudo provocar un p\u00e1nico en el n\u00facleo. Este parche a\u00f1ade arch_check_kprobe en arch_prepare_kprobe para evitar una posici\u00f3n ilegal (como la mitad de una instrucci\u00f3n).\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.12\",\"versionEndExcluding\":\"5.15.93\",\"matchCriteriaId\":\"C71DDF39-39C1-4B06-990E-9106C348F502\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndIncluding\":\"6.1.11\",\"matchCriteriaId\":\"954792E4-20E7-4E05-BB20-8A78D5FEAD45\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF501633-2F44-4913-A8EE-B021929F49F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BDA597B-CAC1-4DF0-86F0-42E142C654E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"725C78C9-12CE-406F-ABE8-0813A01D66E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A127C155-689C-4F67-B146-44A57F4BFD85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"D34127CC-68F5-4703-A5F6-5006F803E4AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AB8D555-648E-4F2F-98BD-3E7F45BD12A8\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04a73558209554da17f46490ec4faaaf1b2bab68\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/12316538b1d193064109ce1a28fc9bacd43950de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/87f48c7ccc73afc78630530d9af51f458f58cab8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.