Bug 1222263 (CVE-2023-52633) - VUL-0: CVE-2023-52633: kernel: um: time-travel: fix time corruption
Summary: VUL-0: CVE-2023-52633: kernel: um: time-travel: fix time corruption
Status: RESOLVED INVALID
Alias: CVE-2023-52633
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/399956/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-03 07:39 UTC by SMASH SMASH
Modified: 2024-04-03 09:53 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-04-03 07:39:01 UTC
In the Linux kernel, the following vulnerability has been resolved:

um: time-travel: fix time corruption

In 'basic' time-travel mode (without =inf-cpu or =ext), we
still get timer interrupts. These can happen at arbitrary
points in time, i.e. while in timer_read(), which pushes
time forward just a little bit. Then, if we happen to get
the interrupt after calculating the new time to push to,
but before actually finishing that, the interrupt will set
the time to a value that's incompatible with the forward,
and we'll crash because time goes backwards when we do the
forwarding.

Fix this by reading the time_travel_time, calculating the
adjustment, and doing the adjustment all with interrupts
disabled.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52633
https://www.cve.org/CVERecord?id=CVE-2023-52633
https://git.kernel.org/stable/c/0c7478a2da3f5fe106b4658338873d50c86ac7ab
https://git.kernel.org/stable/c/4f7dad73df4cdb2b7042103d3922745d040ad025
https://git.kernel.org/stable/c/abe4eaa8618bb36c2b33e9cdde0499296a23448c
https://git.kernel.org/stable/c/b427f55e9d4185f6f17cc1e3296eb8d0c4425283
https://git.kernel.org/stable/c/de3e9d8e8d1ae0a4d301109d1ec140796901306c
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2023/CVE-2023-52633.mbox
https://bugzilla.redhat.com/show_bug.cgi?id=2272802
Comment 1 Shung-Hsi Yu 2024-04-03 08:03:11 UTC
IIUC um stand for user-mode Linux, where the Linux kernel is built as a user-space program for testing purpose (basically running Linux kernel without the need of a emulator), and all arch/um code is never run in a actual kernel. Thus I think this can be rejected.
Comment 2 Shung-Hsi Yu 2024-04-03 08:15:29 UTC
But as per https://user-mode-linux.sourceforge.net/ it doesn't seem like UML is limited to testing, so I'm less sure whether we want to dispute this CVE.

> User-Mode Linux is a safe, secure way of running Linux versions and Linux processes. Run buggy software, experiment with new Linux kernels or distributions, and poke around in the internals of Linux, all without risking your main Linux setup.
> 
> User-Mode Linux gives you a virtual machine that may have more hardware and software virtual resources than your actual, physical computer. Disk storage for the virtual machine is entirely contained inside a single file on your physical machine. You can assign your virtual machine only the hardware access you want it to have. With properly limited access, nothing you do on the virtual machine can change or damage your real computer, or its software.
Comment 3 Shung-Hsi Yu 2024-04-03 08:16:55 UTC
But anyway this doesn't affect us, so reassigning back to security team.
Comment 4 Robert Frohl 2024-04-03 09:53:23 UTC
(In reply to Shung-Hsi Yu from comment #3)
> But anyway this doesn't affect us, so reassigning back to security team.

thanks, closing the bug