1224693 – (CVE-2023-52677) VUL-0: CVE-2023-52677: kernel: riscv: Check if the code to patch lies in the exit section

Bug 1224693 (CVE-2023-52677) - VUL-0: CVE-2023-52677: kernel: riscv: Check if the code to patch lies in the exit section

Summary: VUL-0: CVE-2023-52677: kernel: riscv: Check if the code to patch lies in the ...

Status:	RESOLVED INVALID

Alias:	CVE-2023-52677

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assignee:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/406388/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-52677:5.5:(AV:...
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2024-05-20 16:06 UTC by SMASH SMASH
Modified:	2024-05-28 09:35 UTC (History)
CC List:	4 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description SMASH SMASH 2024-05-20 16:06:58 UTC

In the Linux kernel, the following vulnerability has been resolved:

riscv: Check if the code to patch lies in the exit section

Otherwise we fall through to vmalloc_to_page() which panics since the
address does not lie in the vmalloc region.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52677
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2023/CVE-2023-52677.mbox
https://git.kernel.org/stable/c/938f70d14618ec72e10d6fcf8a546134136d7c13
https://git.kernel.org/stable/c/890cfe5337e0aaf03ece1429db04d23c88da72e7
https://git.kernel.org/stable/c/8db56df4a954b774bdc68917046a685a9fa2e4bc
https://git.kernel.org/stable/c/1d7a03052846f34d624d0ab41a879adf5e85c85f
https://git.kernel.org/stable/c/420370f3ae3d3b883813fd3051a38805160b2b9f
https://www.cve.org/CVERecord?id=CVE-2023-52677
https://bugzilla.redhat.com/show_bug.cgi?id=2281330

Comment 1 Joey Lee 2024-05-21 07:10:55 UTC

https://www.suse.com/security/cve/CVE-2023-52677.html
cvss 5.5

Comment 2 Joey Lee 2024-05-22 15:49:41 UTC

We do NOT official support RISCV. Should we handle this CVE?

Comment 3 Thomas Leroy 2024-05-28 09:35:27 UTC

(In reply to Joey Lee from comment #2)
> We do NOT official support RISCV. Should we handle this CVE?

Nothing to do here. Closing.
Let me close all riscv bugs