CVE-2023-52797 in Linux
Summary
by MITRE • 05/21/2024
In the Linux kernel, the following vulnerability has been resolved:
drivers: perf: Check find_first_bit() return value
We must check the return value of find_first_bit() before using the return value as an index array since it happens to overflow the array and then panic:
[ 107.318430] Kernel BUG [#1]
[ 107.319434] CPU: 3 PID: 1238 Comm: kill Tainted: G E 6.6.0-rc6ubuntu-defconfig #2
[ 107.319465] Hardware name: riscv-virtio,qemu (DT)
[ 107.319551] epc : pmu_sbi_ovf_handler+0x3a4/0x3ae
[ 107.319840] ra : pmu_sbi_ovf_handler+0x52/0x3ae
[ 107.319868] epc : ffffffff80a0a77c ra : ffffffff80a0a42a sp : ffffaf83fecda350
[ 107.319884] gp : ffffffff823961a8 tp : ffffaf8083db1dc0 t0 : ffffaf83fecda480
[ 107.319899] t1 : ffffffff80cafe62 t2 : 000000000000ff00 s0 : ffffaf83fecda520
[ 107.319921] s1 : ffffaf83fecda380 a0 : 00000018fca29df0 a1 : ffffffffffffffff
[ 107.319936] a2 : 0000000001073734 a3 : 0000000000000004 a4 : 0000000000000000
[ 107.319951] a5 : 0000000000000040 a6 : 000000001d1c8774 a7 : 0000000000504d55
[ 107.319965] s2 : ffffffff82451f10 s3 : ffffffff82724e70 s4 : 000000000000003f
[ 107.319980] s5 : 0000000000000011 s6 : ffffaf8083db27c0 s7 : 0000000000000000
[ 107.319995] s8 : 0000000000000001 s9 : 00007fffb45d6558 s10: 00007fffb45d81a0
[ 107.320009] s11: ffffaf7ffff60000 t3 : 0000000000000004 t4 : 0000000000000000
[ 107.320023] t5 : ffffaf7f80000000 t6 : ffffaf8000000000
[ 107.320037] status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000003
[ 107.320081] [] pmu_sbi_ovf_handler+0x3a4/0x3ae
[ 107.320112] [] handle_percpu_devid_irq+0x9e/0x1a0
[ 107.320131] [] generic_handle_domain_irq+0x28/0x36
[ 107.320148] [] riscv_intc_irq+0x36/0x4e
[ 107.320166] [] handle_riscv_irq+0x54/0x86
[ 107.320189] [] do_irq+0x64/0x96
[ 107.320271] Code: 85a6 855e b097 ff7f 80e7 9220 b709 9002 4501 bbd9 (9002) 6097
[ 107.320585] ---[ end trace 0000000000000000 ]---
[ 107.320704] Kernel panic - not syncing: Fatal exception in interrupt
[ 107.320775] SMP: stopping secondary CPUs
[ 107.321219] Kernel Offset: 0x0 from 0xffffffff80000000
[ 107.333051] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/22/2025
The vulnerability CVE-2023-52797 resides within the Linux kernel's performance monitoring unit driver, specifically in the handling of the find_first_bit() function return value during interrupt processing. This flaw represents a classic case of improper input validation that can lead to kernel panic and system instability. The issue manifests when the kernel attempts to use the return value of find_first_bit() as an array index without first verifying that the returned value falls within acceptable bounds. This oversight can cause memory corruption and ultimately result in a kernel panic as evidenced by the crash log showing a fatal exception in interrupt handling.
The technical root cause stems from a lack of bounds checking when processing performance monitoring unit overflow interrupts on riscv architecture platforms. The find_first_bit() function returns the index of the first set bit in a bitmap, but when this value exceeds the allocated array size, it results in an out-of-bounds memory access. This particular vulnerability is classified as a buffer overflow condition that can be exploited to cause system crashes, making it particularly dangerous in production environments where system stability is paramount. The vulnerability affects the pmu_sbi_ovf_handler function which handles SBI (Supervisor Binary Interface) overflow interrupts in performance monitoring units, demonstrating how low-level hardware abstraction layer components can introduce critical security flaws.
The operational impact of this vulnerability extends beyond simple system crashes to potentially enable denial-of-service attacks against systems relying on performance monitoring features. Attackers could theoretically trigger the overflow condition through specific performance counter configurations or by generating sufficient interrupt load to cause the find_first_bit() function to return an invalid index. This vulnerability affects systems running Linux kernel versions including 6.6.0-rc6ubuntu-defconfig and likely other versions where the perf driver has not been patched. The vulnerability is particularly concerning in embedded systems, cloud infrastructure, and server environments where performance monitoring is actively used and system uptime is critical.
Mitigation strategies for CVE-2023-52797 involve applying the official kernel patch that implements proper bounds checking on the find_first_bit() return value before using it as an array index. System administrators should prioritize updating to kernel versions that contain the fix, typically those released after the vulnerability disclosure. Additionally, monitoring for performance monitoring unit overflow interrupts and implementing proper logging of such events can help detect potential exploitation attempts. The fix aligns with security best practices outlined in CWE-129 and CWE-787, which address issues related to insufficient input validation and out-of-bounds reads. Organizations should also consider implementing runtime protections such as kernel hardening options and address space layout randomization to reduce the effectiveness of potential exploitation attempts. This vulnerability highlights the importance of proper input validation in kernel space code and demonstrates how seemingly minor oversights can lead to critical system failures.