Linux Kernel up to 6.5.8 sev-shared.c race condition

Summaryinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.5.8. Affected is an unknown function of the file arch/x86/kernel/sev-shared.c. The manipulation leads to race condition. This vulnerability is documented as CVE-2023-46813. The attack needs to be performed locally. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.5.8 (Operating System) and classified as critical. This issue affects an unknown functionality of the file arch/x86/kernel/sev-shared.c. The manipulation with an unknown input leads to a race condition vulnerability. Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.

The weakness was released 10/27/2023. It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2023-46813 since 10/27/2023. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 239841 (TencentOS Server 4: kernel (TSSA-2024:0960)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.5.9 eliminates this vulnerability. The upgrade is hosted for download at cdn.kernel.org. Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (239841). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.5.0
• 6.5.1
• 6.5.2
• 6.5.3
• 6.5.4
• 6.5.5
• 6.5.6
• 6.5.7
• 6.5.8

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion