CVE-2023-52504

What it actually does

KASAN instrumentation in apply_alternatives() performs out-of-bounds reads on 5-level paging systems because cpu_feature_enabled() for LA57 is patched while KASAN_SHADOW_START still depends on the old __VIRTUAL_MASK_SHIFT value, causing KASAN itself to fault during text_poke_early().

Why it matters to the business

Systems using 5-level paging may experience boot-time kernel crashes or instability when KASAN is enabled, delaying deployments and increasing operational risk until kernels are updated.

How an attack unfolds

An attacker would need local code execution or the ability to trigger early kernel patching on a vulnerable 5-level paging machine with KASAN enabled; the flaw is not remotely exploitable and primarily manifests as a stability issue rather than a direct code-execution vector.

How to fix it

Apply the upstream fix in commit 3719d3c36aa853d5a2401af9f8d6b116c91ad5ae or later stable kernels that disable KASAN while alternatives are applied; rebuild and reboot with the updated kernel image.

How to confirm the fix worked

Boot the patched kernel with KASAN enabled on a 5-level paging system and confirm that apply_alternatives() completes without KASAN reports; verify the commit is present via git log or kernel version string.

Typical attack path

1. Obtain local execution context on target
2. Trigger kernel initialization or live-patching path that calls apply_alternatives()
3. Observe KASAN out-of-bounds fault in rcu_is_watching() during feature patching

How to detect it

Examine kernel boot logs and KASAN reports for out-of-bounds accesses originating from apply_alternatives() or text_poke_early() during early boot on 5-level paging hardware; no post-exploitation artifacts are expected.

What your security team should do

• Prioritize kernel updates containing commit 3719d3c36aa853d5a2401af9f8d6b116c91ad5ae on all x86_64 systems using 5-level paging
• Test KASAN-enabled builds in staging before production rollout
• Monitor for future similar circular-dependency issues in architecture-specific patching code