CVE-2023-52633

What it actually does

Race condition in basic time-travel mode allows timer interrupts to set system time to an incompatible value after adjustment calculation but before commit, resulting in backwards time movement and kernel crash.

Why it matters to the business

Systems using time-travel mode (such as certain simulation or testing workloads) may experience unexpected crashes, leading to downtime and loss of in-progress work; low EPSS and no KEV status indicate limited real-world attacker interest 927 days after publication.

How an attack unfolds

An attacker with local access triggers or waits for a timer interrupt during the unprotected time adjustment window in time-travel mode, causing the kernel to detect backwards time and panic; no named threat actors or ransomware usage reported.

How to fix it

Update the Linux kernel to the fixed commit 0c7478a2da3f5fe106b4658338873d50c86ac7ab or later stable release containing the patch that disables interrupts while reading time_travel_time, calculating, and applying the adjustment.

How to confirm the fix worked

Confirm the running kernel includes commit 0c7478a2da3f5fe106b4658338873d50c86ac7ab; verify time-travel paths now execute the full sequence with interrupts disabled; re-test timer interrupt scenarios under basic time-travel mode.

Typical attack path

1. Obtain local code execution on affected Linux kernel
2. Enter or trigger basic time-travel mode without inf-cpu or ext options
3. Arrange for timer interrupt to fire between time calculation and commit
4. Force time value inconsistency that triggers backwards-time check and crash

How to detect it

Search kernel logs for time-travel related panic messages or backwards-time assertions; examine audit and system logs around the time of any unexpected reboots for evidence of timer interrupt activity coinciding with time adjustments.

What your security team should do

• Prioritize kernel upgrade on any systems using time-travel mode within the next maintenance window
• Review kernel configuration to determine if time-travel mode is enabled in production
• Monitor for future stable kernel releases that backport the fix
• Apply compensating controls such as disabling time-travel mode where feasible until patched