Linux Kernel up to 6.1.21/6.2.8 x86_perf_event_set_period infinite loop

Summaryinfo

A vulnerability classified as critical was found in Linux Kernel up to 6.1.21/6.2.8. This vulnerability affects the function x86_perf_event_set_period. Such manipulation leads to infinite loop. This vulnerability is traded as CVE-2023-53073. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.1.21/6.2.8. Affected by this issue is the function x86_perf_event_set_period. The manipulation with an unknown input leads to a infinite loop vulnerability. Using CWE to declare the problem leads to CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. Impacted is availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/core: Always clear status for idx The variable 'status' (which contains the unhandled overflow bits) is not being properly masked in some cases, displaying the following warning: WARNING: CPU: 156 PID: 475601 at arch/x86/events/amd/core.c:972 amd_pmu_v2_handle_irq+0x216/0x270 This seems to be happening because the loop is being continued before the status bit being unset, in case x86_perf_event_set_period() returns 0. This is also causing an inconsistency because the "handled" counter is incremented, but the status bit is not cleaned. Move the bit cleaning together above, together when the "handled" counter is incremented.

The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2023-53073 since 05/02/2025. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 241778 (Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1054)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.1.22 or 6.2.9 eliminates this vulnerability. Applying the patch ab33a8f7649b0324639a336e1081aaea51a4523e/9d4c7b1f12e101d6d6253092588b127416ddfb6c/263f5ecaf7080513efc248ec739b6d9e00f4129f is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (241778). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.1.0
• 6.1.1
• 6.1.2
• 6.1.3
• 6.1.4
• 6.1.5
• 6.1.6
• 6.1.7
• 6.1.8
• 6.1.9
• 6.1.10
• 6.1.11
• 6.1.12
• 6.1.13
• 6.1.14
• 6.1.15
• 6.1.16
• 6.1.17
• 6.1.18
• 6.1.19
• 6.1.20
• 6.1.21
• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3
• 6.2.4
• 6.2.5
• 6.2.6
• 6.2.7
• 6.2.8

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion