CVE-2023-52683

What it actually does

Possible u32 multiplication overflow in lpit_update_residency() when tsc_khz exceeds UINT_MAX/1000, producing incorrect ACPI LPIT residency values in the Linux kernel.

Why it matters to the business

High-TSC-frequency systems may experience incorrect power-management calculations, leading to unexpected performance or stability issues; prevalence across Linux distributions increases exposure surface for kernel-level workloads.

How an attack unfolds

An attacker with local access triggers lpit_update_residency() on a system where tsc_khz is large enough to overflow the multiplication, causing the kernel to store or use corrupted residency data that may be leveraged for further kernel abuse.

How to fix it

Upgrade the Linux kernel to commit 647d1d50c31e60ef9ccb9756a8fdf863329f7aee or later; apply the mul_u32_u32() change in lpit_update_residency().

How to confirm the fix worked

Confirm kernel source contains the mul_u32_u32() call in lpit_update_residency(); verify tsc_khz handling no longer performs direct u32 multiplication.

Typical attack path

1. Obtain local code execution on target Linux system
2. Ensure or force conditions where tsc_khz > UINT_MAX/1000
3. Trigger ACPI LPIT residency update path
4. Observe or exploit resulting incorrect kernel state

How to detect it

Review kernel logs for ACPI LPIT messages or residency anomalies; inspect source or running kernel for the vulnerable multiplication before the referenced commit.

What your security team should do

• Prioritize kernel updates on all systems with high TSC frequencies
• Monitor for any power-management anomalies after patching
• Restrict local access until patches are deployed