Bugzilla – Bug 1222263
VUL-0: CVE-2023-52633: kernel: um: time-travel: fix time corruption
Last modified: 2024-04-03 09:53:23 UTC
In the Linux kernel, the following vulnerability has been resolved: um: time-travel: fix time corruption In 'basic' time-travel mode (without =inf-cpu or =ext), we still get timer interrupts. These can happen at arbitrary points in time, i.e. while in timer_read(), which pushes time forward just a little bit. Then, if we happen to get the interrupt after calculating the new time to push to, but before actually finishing that, the interrupt will set the time to a value that's incompatible with the forward, and we'll crash because time goes backwards when we do the forwarding. Fix this by reading the time_travel_time, calculating the adjustment, and doing the adjustment all with interrupts disabled. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52633 https://www.cve.org/CVERecord?id=CVE-2023-52633 https://git.kernel.org/stable/c/0c7478a2da3f5fe106b4658338873d50c86ac7ab https://git.kernel.org/stable/c/4f7dad73df4cdb2b7042103d3922745d040ad025 https://git.kernel.org/stable/c/abe4eaa8618bb36c2b33e9cdde0499296a23448c https://git.kernel.org/stable/c/b427f55e9d4185f6f17cc1e3296eb8d0c4425283 https://git.kernel.org/stable/c/de3e9d8e8d1ae0a4d301109d1ec140796901306c https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2023/CVE-2023-52633.mbox https://bugzilla.redhat.com/show_bug.cgi?id=2272802
IIUC um stand for user-mode Linux, where the Linux kernel is built as a user-space program for testing purpose (basically running Linux kernel without the need of a emulator), and all arch/um code is never run in a actual kernel. Thus I think this can be rejected.
But as per https://user-mode-linux.sourceforge.net/ it doesn't seem like UML is limited to testing, so I'm less sure whether we want to dispute this CVE. > User-Mode Linux is a safe, secure way of running Linux versions and Linux processes. Run buggy software, experiment with new Linux kernels or distributions, and poke around in the internals of Linux, all without risking your main Linux setup. > > User-Mode Linux gives you a virtual machine that may have more hardware and software virtual resources than your actual, physical computer. Disk storage for the virtual machine is entirely contained inside a single file on your physical machine. You can assign your virtual machine only the hardware access you want it to have. With properly limited access, nothing you do on the virtual machine can change or damage your real computer, or its software.
But anyway this doesn't affect us, so reassigning back to security team.
(In reply to Shung-Hsi Yu from comment #3) > But anyway this doesn't affect us, so reassigning back to security team. thanks, closing the bug