CVE-2023-52450

What it actually does

NULL pointer dereference in upi_fill_topology() caused by using physical socket ID instead of logical ID when indexing into the uncore topology array, resulting in out-of-bounds access and kernel crash.

Why it matters to the business

Local denial of service on Linux systems using Intel uncore performance monitoring; systems may panic or become unavailable during perf topology discovery, with higher impact on servers and developer workstations running recent kernels.

How an attack unfolds

An attacker with local access triggers Intel uncore perf topology initialization (via perf events or module load) so that discover_upi_topology() supplies an out-of-range nid, causing the subsequent upi_fill_topology() call to dereference a NULL entry.

How to fix it

Upgrade the Linux kernel to the commit bf1bf09e6b599758851457f3999779622a48d015 or later stable releases that contain the fix; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains commit bf1bf09e6b599758851457f3999779622a48d015; test that perf uncore events initialize without NULL dereference on affected Intel platforms.

Typical attack path

1. Obtain local shell or unprivileged user access on a vulnerable kernel
2. Load or exercise perf/x86/intel/uncore code paths that invoke discover_upi_topology()
3. Supply or allow a physical socket ID that maps outside the allocated topology array bounds
4. Trigger upi_fill_topology() to perform the out-of-bounds NULL dereference and crash the kernel

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for NULL pointer dereference oops messages originating from perf/x86/intel/uncore during upi_fill_topology or discover_upi_topology; correlate with perf event activity.

• NULL pointer dereference in upi_fill_topology()
• WARNING: CPU: .* PID: .* at drivers/perf/x86/intel/uncore_discovery.c
• BUG: unable to handle page fault for address: 0000000000000.* in upi_fill_topology

What your security team should do

• Prioritize kernel upgrades on all Intel-based Linux hosts that expose perf uncore monitoring
• Apply the patch within standard maintenance windows given the low EPSS and lack of KEV listing
• Restrict unprivileged perf access via sysctl kernel.perf_event_paranoid until patches are deployed