CVE-2023-52476: perf/x86/lbr: Filter vsyscall addresses
In the Linux kernel, the following vulnerability has been resolved:
perf/x86/lbr: Filter vsyscall addresses
The Linux kernel CVE team has assigned CVE-2023-52476 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024022921-CVE-2023-52476-e307@gregkh/T/#u
Other sources
In the Linux kernel, the following vulnerability has been resolved:
perf/x86/lbr: Filter vsyscall addresses
We found that a panic can occur when a vsyscall is made while LBR sampling is active. If the vsyscall is interrupted (NMI) for perf sampling, this call sequence can occur (most recent at top):
insngetemulateprefix() insngetemulateprefix() insngetprefixes() insngetopcode() decodebranchtype() getbranchtype() intelpmulbrfilter() intelpmuhandleirq() perfeventnmihandler()
Within insngetemulateprefix() at frame 0, a macro is called:
peeknbytenext(insnbytet, insn, i)
Within this macro, this dereference occurs:
(insn)->nextbyte
Inspecting registers at this point, the value of the nextbyte field is the address of the vsyscall made, for example the location of the vsyscall version of gettimeofday() at 0xffffffffff600000. The access to an address in the vsyscall region will trigger an oops due to an unhandled page fault.
To fix the bug, filtering for vsyscalls can be done when determining the branch type. This patch will return a "none" branch if a kernel address if found to lie in the vsyscall region.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52476?
CVE-2023-52476 is a vulnerability in the Linux kernel that has been categorized with a specific severity rating, indicating potential impacts on system integrity.
How do I fix CVE-2023-52476?
To mitigate CVE-2023-52476, update your Linux kernel to version 5.15.137, 6.1.59, 6.5.8, or 6.6 and apply the relevant patches.
What versions of the Linux kernel are affected by CVE-2023-52476?
CVE-2023-52476 affects specific kernel versions prior to 5.15.137, 6.1.59, 6.5.8, and all 6.6 release candidates.
Is there a workaround for CVE-2023-52476?
Currently, the best solution for CVE-2023-52476 is to update the kernel to the latest patched version.
When was CVE-2023-52476 discovered?
CVE-2023-52476 was identified as a vulnerability in the Linux kernel and has been documented in 2023.