Bug 1222263 (CVE-2023-52633)

Summary:	VUL-0: CVE-2023-52633: kernel: um: time-travel: fix time corruption
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED INVALID	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	rfrohl, shung-hsi.yu
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/399956/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-04-03 07:39:01 UTC

In the Linux kernel, the following vulnerability has been resolved:

um: time-travel: fix time corruption

In 'basic' time-travel mode (without =inf-cpu or =ext), we
still get timer interrupts. These can happen at arbitrary
points in time, i.e. while in timer_read(), which pushes
time forward just a little bit. Then, if we happen to get
the interrupt after calculating the new time to push to,
but before actually finishing that, the interrupt will set
the time to a value that's incompatible with the forward,
and we'll crash because time goes backwards when we do the
forwarding.

Fix this by reading the time_travel_time, calculating the
adjustment, and doing the adjustment all with interrupts
disabled.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52633
https://www.cve.org/CVERecord?id=CVE-2023-52633
https://git.kernel.org/stable/c/0c7478a2da3f5fe106b4658338873d50c86ac7ab
https://git.kernel.org/stable/c/4f7dad73df4cdb2b7042103d3922745d040ad025
https://git.kernel.org/stable/c/abe4eaa8618bb36c2b33e9cdde0499296a23448c
https://git.kernel.org/stable/c/b427f55e9d4185f6f17cc1e3296eb8d0c4425283
https://git.kernel.org/stable/c/de3e9d8e8d1ae0a4d301109d1ec140796901306c
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2023/CVE-2023-52633.mbox
https://bugzilla.redhat.com/show_bug.cgi?id=2272802

Comment 1 Shung-Hsi Yu 2024-04-03 08:03:11 UTC

IIUC um stand for user-mode Linux, where the Linux kernel is built as a user-space program for testing purpose (basically running Linux kernel without the need of a emulator), and all arch/um code is never run in a actual kernel. Thus I think this can be rejected.

Comment 2 Shung-Hsi Yu 2024-04-03 08:15:29 UTC

But as per https://user-mode-linux.sourceforge.net/ it doesn't seem like UML is limited to testing, so I'm less sure whether we want to dispute this CVE.

> User-Mode Linux is a safe, secure way of running Linux versions and Linux processes. Run buggy software, experiment with new Linux kernels or distributions, and poke around in the internals of Linux, all without risking your main Linux setup.
> 
> User-Mode Linux gives you a virtual machine that may have more hardware and software virtual resources than your actual, physical computer. Disk storage for the virtual machine is entirely contained inside a single file on your physical machine. You can assign your virtual machine only the hardware access you want it to have. With properly limited access, nothing you do on the virtual machine can change or damage your real computer, or its software.

Comment 3 Shung-Hsi Yu 2024-04-03 08:16:55 UTC

But anyway this doesn't affect us, so reassigning back to security team.

Comment 4 Robert Frohl 2024-04-03 09:53:23 UTC

(In reply to Shung-Hsi Yu from comment #3)
> But anyway this doesn't affect us, so reassigning back to security team.

thanks, closing the bug