CVE-2023-52733

What it actually does

The s390 decompressor fails to pass the known uncompressed kernel image size as out_len to __decompress(), allowing the zstd library to write literal data into memory beyond the destination buffer and corrupt adjacent structures such as initrd or IPL report.

Why it matters to the business

Unpatched s390 systems risk boot-time memory corruption that can lead to kernel crashes, failed starts, or local privilege escalation; the issue affects Debian 11 installations and requires prompt kernel updates to maintain system integrity and availability.

How an attack unfolds

An attacker with local access supplies or modifies data processed during early boot decompression; the zstd routine then reuses the unwritten portion of the destination buffer, overwriting neighboring memory regions and enabling control-flow hijacking or denial of service on affected s390 kernels.

How to fix it

Upgrade the linux package on Debian 11 to version 5.10.178-1 or later; rebuild and reinstall the kernel, then reboot s390 systems to activate the corrected decompressor that supplies the proper out_len parameter.

How to confirm the fix worked

Verify installed kernel version matches or exceeds 5.10.178-1, confirm the decompressor source contains the out_len argument, and test a clean boot sequence on representative s390 hardware.

Typical attack path

1. Obtain local shell on target s390 system
2. Trigger kernel or initrd decompression path (e.g., reboot or kexec)
3. Cause zstd to store literals past the intended out_len boundary
4. Corrupt adjacent memory to achieve privilege escalation or crash

How to detect it

Review early-boot logs, dmesg output, and IPL records on s390 systems for unexpected memory corruption messages or failures immediately after decompression; correlate with any local-user-initiated reboots or kexec operations.

What your security team should do

• Immediately schedule upgrades for all Debian 11 s390 instances to 5.10.178-1
• Prioritize systems that use zstd-compressed kernels or place initrd immediately after the decompressor buffer
• Monitor boot logs for decompression-related faults until patches are deployed