Bug 1225039 (CVE-2023-52823) - VUL-0: REJECTED: CVE-2023-52823: kernel: kernel: kexec: copy user-array safely
Summary: VUL-0: REJECTED: CVE-2023-52823: kernel: kernel: kexec: copy user-array safely
Status: RESOLVED INVALID
Alias: CVE-2023-52823
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/407102/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-52823:4.4:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-05-22 15:04 UTC by SMASH SMASH
Modified: 2024-05-24 14:50 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Michal Hocko 2024-05-23 15:10:55 UTC
This is not a security issue but rather a hardening. Considering that kexec is a privileged operation I do not think we need this fix. What do you think Jiri?
Comment 3 Jiri Bohac 2024-05-24 09:32:17 UTC
This CVE is invalid. The overflow check is in the kexec_load_check() function called shortly before the memdup_user() call:

SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments,
                struct kexec_segment __user *, segments, unsigned long, flags)
{
        result = kexec_load_check(nr_segments, flags);
        if (result)
                return result;
...
        ksegments = memdup_user(segments, nr_segments * sizeof(ksegments[0]));
...
}

#define KEXEC_SEGMENT_MAX 16
static inline int kexec_load_check(unsigned long nr_segments,
                                   unsigned long flags)
{
...
        if (nr_segments > KEXEC_SEGMENT_MAX)
                return -EINVAL;
}
Comment 4 Jiri Bohac 2024-05-24 10:05:38 UTC
Disputed: https://lore.kernel.org/lkml/ZlBlorsBMPK0RdnR@dwarf.suse.cz/
Comment 6 Andrea Mattiazzo 2024-05-24 14:50:15 UTC
Closing as CVE was rejected. Thanks all.