Cloudanix VulnDB

CVE-2023-52797

None

CVSS

—

EPSS

0.3%

Published

May 21, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug can make the whole computer crash when certain performance tracking events happen.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw fails to validate the return value of find_first_bit() before using it as an array index in the perf SBI overflow handler (pmu_sbi_ovf_handler), causing out-of-bounds memory access and kernel panic on RISC-V.

Why it matters to the business

Leads to unexpected system crashes and loss of availability on affected Linux systems, disrupting workloads especially on RISC-V platforms without requiring elevated privileges.

How an attack unfolds

A local attacker crafts perf event configurations or uses userspace tools to trigger an overflow condition in the performance monitoring unit on RISC-V; the handler then receives an unchecked bit index that overflows an array, dereferences invalid memory, and forces a kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing commit 2c86b24095fcf72cf51bc72d12e4350163b4e11d which adds the required return-value check before indexing; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Inspect the pmu_sbi_ovf_handler source for an explicit bounds check on the find_first_bit result prior to array access; confirm the running kernel reports the fixed commit or later stable tag.

Typical attack path

  1. Gain local unprivileged access to a RISC-V Linux system
  2. Configure or trigger perf events to induce an SBI overflow
  3. Invoke the pmu_sbi_ovf_handler path
  4. find_first_bit returns an out-of-range value used as array index
  5. Kernel BUG and panic occurs

How to detect it

Search kernel logs and crash dumps for strings referencing pmu_sbi_ovf_handler, find_first_bit overflow, or the exact panic trace on RISC-V systems; correlate with perf subsystem activity preceding the crash.

  • pmu_sbi_ovf_handler+0x3a4/0x3ae
  • Kernel BUG [#1]
  • Fatal exception in interrupt
  • find_first_bit

What your security team should do

  • Apply the referenced kernel commit immediately on all RISC-V deployments
  • Test patched kernels in staging before production rollout
  • Monitor kernel logs for perf-related panics during the update window

The record

In the Linux kernel, the following vulnerability has been resolved: drivers: perf: Check find_first_bit() return value We must check the return value of find_first_bit() before using the return value as an index array since it happens to overflow the array and then panic: [ 107.318430] Kernel BUG [#1] [ 107.319434] CPU: 3 PID: 1238 Comm: kill Tainted: G E 6.6.0-rc6ubuntu-defconfig #2 [ 107.319465] Hardware name: riscv-virtio,qemu (DT) [ 107.319551] epc : pmu_sbi_ovf_handler+0x3a4/0x3ae [ 107.319840] ra : pmu_sbi_ovf_handler+0x52/0x3ae [ 107.319868] epc : ffffffff80a0a77c ra : ffffffff80a0a42a sp : ffffaf83fecda350 [ 107.319884] gp : ffffffff823961a8 tp : ffffaf8083db1dc0 t0 : ffffaf83fecda480 [ 107.319899] t1 : ffffffff80cafe62 t2 : 000000000000ff00 s0 : ffffaf83fecda520 [ 107.319921] s1 : ffffaf83fecda380 a0 : 00000018fca29df0 a1 : ffffffffffffffff [ 107.319936] a2 : 0000000001073734 a3 : 0000000000000004 a4 : 0000000000000000 [ 107.319951] a5 : 0000000000000040 a6 : 000000001d1c8774 a7 : 0000000000504d55 [ 107.319965] s2 : ffffffff82451f10 s3 : ffffffff82724e70 s4 : 000000000000003f [ 107.319980] s5 : 0000000000000011 s6 : ffffaf8083db27c0 s7 : 0000000000000000 [ 107.319995] s8 : 0000000000000001 s9 : 00007fffb45d6558 s10: 00007fffb45d81a0 [ 107.320009] s11: ffffaf7ffff60000 t3 : 0000000000000004 t4 : 0000000000000000 [ 107.320023] t5 : ffffaf7f80000000 t6 : ffffaf8000000000 [ 107.320037] status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000003 [ 107.320081] [<ffffffff80a0a77c>] pmu_sbi_ovf_handler+0x3a4/0x3ae [ 107.320112] [<ffffffff800b42d0>] handle_percpu_devid_irq+0x9e/0x1a0 [ 107.320131] [<ffffffff800ad92c>] generic_handle_domain_irq+0x28/0x36 [ 107.320148] [<ffffffff8065f9f8>] riscv_intc_irq+0x36/0x4e [ 107.320166] [<ffffffff80caf4a0>] handle_riscv_irq+0x54/0x86 [ 107.320189] [<ffffffff80cb0036>] do_irq+0x64/0x96 [ 107.320271] Code: 85a6 855e b097 ff7f 80e7 9220 b709 9002 4501 bbd9 (9002) 6097 [ 107.320585] ---[ end trace 0000000000000000 ]--- [ 107.320704] Kernel panic - not syncing: Fatal exception in interrupt [ 107.320775] SMP: stopping secondary CPUs [ 107.321219] Kernel Offset: 0x0 from 0xffffffff80000000 [ 107.333051] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---

Affected packages

Ecosystem Package Introduced Fixed
Debian:12 linux 0 No fix
Debian:13 linux 0 6.6.8-1
Linux Kernel 5.18.0 6.5.13
Ubuntu:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure 0 No fix
Ubuntu:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:18.04:LTS linux-gcp 0 No fix
Ubuntu:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:18.04:LTS linux-hwe 0 No fix
Ubuntu:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:18.04:LTS linux-oem 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:20.04:LTS linux 0 5.4.0-9.12
Ubuntu:20.04:LTS linux-aws 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:20.04:LTS linux-aws-5.15 0 5.15.0-1014.18~20.04.1
Ubuntu:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure 0 5.4.0-1006.6
Ubuntu:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:20.04:LTS linux-azure-5.15 0 5.15.0-1007.8~20.04.1
Ubuntu:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:20.04:LTS linux-azure-fde-5.15 0 5.15.0-1019.24~20.04.1.1
Ubuntu:20.04:LTS linux-bluefield 0 5.4.0-1007.10
Ubuntu:20.04:LTS linux-gcp 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:20.04:LTS linux-gcp-5.15 0 5.15.0-1006.9~20.04.1
Ubuntu:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:20.04:LTS linux-gke 0 No fix
Ubuntu:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:20.04:LTS linux-gkeop 0 5.4.0-1008.9
Ubuntu:20.04:LTS linux-gkeop-5.15 0 5.15.0-1003.5~20.04.2
Ubuntu:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:20.04:LTS linux-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:20.04:LTS linux-ibm 0 5.4.0-1003.4
Ubuntu:20.04:LTS linux-ibm-5.15 0 5.15.0-1033.36~20.04.1
Ubuntu:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:20.04:LTS linux-intel-iotg-5.15 0 5.15.0-1003.5~20.04.1
Ubuntu:20.04:LTS linux-iot 0 5.4.0-1001.3
Ubuntu:20.04:LTS linux-kvm 0 5.4.0-1004.4
Ubuntu:20.04:LTS linux-lowlatency-hwe-5.15 0 5.15.0-33.34~20.04.1
Ubuntu:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:20.04:LTS linux-oracle 0 5.4.0-1005.5
Ubuntu:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:20.04:LTS linux-oracle-5.15 0 5.15.0-1007.9~20.04.1
Ubuntu:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:20.04:LTS linux-raspi 0 5.4.0-1007.7
Ubuntu:20.04:LTS linux-raspi2 0 No fix
Ubuntu:20.04:LTS linux-riscv 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:20.04:LTS linux-riscv-5.15 0 5.15.0-1015.17~20.04.1
Ubuntu:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:20.04:LTS linux-xilinx-zynqmp 0 5.4.0-1020.24
Ubuntu:22.04:LTS linux 0 5.13.0-19.19
Ubuntu:22.04:LTS linux-allwinner-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws 0 5.13.0-1005.6
Ubuntu:22.04:LTS linux-aws-5.19 0 No fix
Ubuntu:22.04:LTS linux-aws-6.2 0 No fix
Ubuntu:22.04:LTS linux-aws-6.5 0 No fix
Ubuntu:22.04:LTS linux-azure 0 5.13.0-1006.7
Ubuntu:22.04:LTS linux-azure-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-6.2 0 No fix
Ubuntu:22.04:LTS linux-azure-6.5 0 No fix
Ubuntu:22.04:LTS linux-azure-fde 0 5.15.0-1019.24.1
Ubuntu:22.04:LTS linux-azure-fde-5.19 0 No fix
Ubuntu:22.04:LTS linux-azure-fde-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp 0 5.13.0-1005.6
Ubuntu:22.04:LTS linux-gcp-5.19 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.2 0 No fix
Ubuntu:22.04:LTS linux-gcp-6.5 0 No fix
Ubuntu:22.04:LTS linux-gke 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-gkeop 0 5.15.0-1001.2
Ubuntu:22.04:LTS linux-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-hwe-6.8 0 6.8.0-38.38~22.04.1
Ubuntu:22.04:LTS linux-ibm 0 5.15.0-1002.2
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 No fix
Ubuntu:22.04:LTS linux-intel-iot-realtime 0 5.15.0-1021.26
Ubuntu:22.04:LTS linux-intel-iotg 0 5.15.0-1004.6
Ubuntu:22.04:LTS linux-kvm 0 5.13.0-1004.4
Ubuntu:22.04:LTS linux-lowlatency 0 5.15.0-22.22
Ubuntu:22.04:LTS linux-lowlatency-hwe-5.19 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.2 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.5 0 No fix
Ubuntu:22.04:LTS linux-lowlatency-hwe-6.8 0 6.8.0-38.38.1~22.04.2
Ubuntu:22.04:LTS linux-nvidia 0 5.15.0-1005.5
Ubuntu:22.04:LTS linux-nvidia-6.2 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.5 0 No fix
Ubuntu:22.04:LTS linux-nvidia-6.5 0 6.5.0-1014.14
Ubuntu:22.04:LTS linux-nvidia-6.8 0 6.8.0-1008.8~22.04.1
Ubuntu:22.04:LTS linux-oem-5.17 0 No fix
Ubuntu:22.04:LTS linux-oem-6.0 0 No fix
Ubuntu:22.04:LTS linux-oem-6.1 0 No fix
Ubuntu:22.04:LTS linux-oem-6.5 0 No fix
Ubuntu:22.04:LTS linux-oracle 0 5.13.0-1008.10
Ubuntu:22.04:LTS linux-oracle-6.5 0 No fix
Ubuntu:22.04:LTS linux-raspi 0 5.13.0-1008.9
Ubuntu:22.04:LTS linux-realtime 0 No fix
Ubuntu:22.04:LTS linux-riscv 0 No fix
Ubuntu:22.04:LTS linux-riscv-5.19 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.5 0 No fix
Ubuntu:22.04:LTS linux-riscv-6.8 0 6.8.0-38.38.1~22.04.1
Ubuntu:22.04:LTS linux-starfive-5.19 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.2 0 No fix
Ubuntu:22.04:LTS linux-starfive-6.5 0 No fix
Ubuntu:22.04:LTS linux-xilinx-zynqmp 0 5.15.0-1022.26
Ubuntu:22.04:LTS:for:NVIDIA:BlueField linux-bluefield 0 5.15.0-1011.13
Ubuntu:24.04:LTS linux 0 6.6.0-14.14
Ubuntu:24.04:LTS linux-aws 0 6.6.0-1001.1
Ubuntu:24.04:LTS linux-azure 0 6.6.0-1001.1
Ubuntu:24.04:LTS linux-gcp 0 6.6.0-1001.1
Ubuntu:24.04:LTS linux-gke 0 6.8.0-1003.5
Ubuntu:24.04:LTS linux-gkeop 0 6.8.0-1001.3
Ubuntu:24.04:LTS linux-ibm 0 6.8.0-1001.1
Ubuntu:24.04:LTS linux-lowlatency 0 6.6.0-14.14.1
Ubuntu:24.04:LTS linux-nvidia 0 6.8.0-1007.7
Ubuntu:24.04:LTS linux-nvidia-lowlatency 0 6.8.0-1009.9.1
Ubuntu:24.04:LTS linux-oem-6.8 0 6.8.0-1003.3
Ubuntu:24.04:LTS linux-oracle 0 6.6.0-1001.1
Ubuntu:24.04:LTS linux-raspi 0 6.7.0-1001.1
Ubuntu:24.04:LTS linux-raspi-realtime 0 No fix
Ubuntu:24.04:LTS linux-raspi-realtime 0 6.7.0-2001.1
Ubuntu:24.04:LTS linux-realtime 0 6.8.0-1008.19
Ubuntu:24.04:LTS linux-riscv 0 6.8.0-20.20.1
Ubuntu:Pro:16.04:LTS linux-hwe-edge 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws-5.0 0 No fix
Ubuntu:Pro:18.04:LTS linux-aws-5.3 0 No fix
Ubuntu:Pro:18.04:LTS linux-azure 0 No fix
Ubuntu:Pro:18.04:LTS linux-azure-5.3 0 No fix
Ubuntu:Pro:18.04:LTS linux-azure-edge 0 No fix
Ubuntu:Pro:18.04:LTS linux-gcp 0 No fix
Ubuntu:Pro:18.04:LTS linux-gcp-5.3 0 No fix
Ubuntu:Pro:18.04:LTS linux-gke-4.15 0 No fix
Ubuntu:Pro:18.04:LTS linux-gke-5.4 0 No fix
Ubuntu:Pro:18.04:LTS linux-gkeop-5.4 0 No fix
Ubuntu:Pro:18.04:LTS linux-hwe 0 No fix
Ubuntu:Pro:18.04:LTS linux-hwe-edge 0 No fix
Ubuntu:Pro:18.04:LTS linux-oem 0 No fix
Ubuntu:Pro:18.04:LTS linux-oracle-5.0 0 No fix
Ubuntu:Pro:18.04:LTS linux-oracle-5.3 0 No fix
Ubuntu:Pro:20.04:LTS linux-aws-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-aws-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-aws-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-azure-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-azure-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-azure-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-azure-fde 0 No fix
Ubuntu:Pro:20.04:LTS linux-gcp-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-gcp-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-gcp-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-gke 0 No fix
Ubuntu:Pro:20.04:LTS linux-gke-5.15 0 No fix
Ubuntu:Pro:20.04:LTS linux-hwe-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-hwe-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-hwe-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-intel-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-oem-5.10 0 No fix
Ubuntu:Pro:20.04:LTS linux-oem-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-oem-5.14 0 No fix
Ubuntu:Pro:20.04:LTS linux-oem-5.6 0 No fix
Ubuntu:Pro:20.04:LTS linux-oracle-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-oracle-5.13 0 No fix
Ubuntu:Pro:20.04:LTS linux-oracle-5.8 0 No fix
Ubuntu:Pro:20.04:LTS linux-raspi2 0 No fix
Ubuntu:Pro:20.04:LTS linux-riscv 0 No fix
Ubuntu:Pro:20.04:LTS linux-riscv-5.11 0 No fix
Ubuntu:Pro:20.04:LTS linux-riscv-5.8 0 No fix
Ubuntu:Pro:FIPS-preview:22.04:LTS linux-aws-fips 0 5.15.0-1051.56+fips1
Ubuntu:Pro:FIPS-preview:22.04:LTS linux-azure-fips 0 5.15.0-1053.61+fips1
Ubuntu:Pro:FIPS-preview:22.04:LTS linux-fips 0 5.15.0-73.80+fips1
Ubuntu:Pro:FIPS-preview:22.04:LTS linux-gcp-fips 0 5.15.0-1048.56+fips1
Ubuntu:Pro:FIPS-updates:18.04:LTS linux-aws-fips 0 4.15.0-2000.4
Ubuntu:Pro:FIPS-updates:18.04:LTS linux-azure-fips 0 4.15.0-1002.2
Ubuntu:Pro:FIPS-updates:18.04:LTS linux-fips 0 4.15.0-1027.32
Ubuntu:Pro:FIPS-updates:18.04:LTS linux-gcp-fips 0 4.15.0-2013.14
Ubuntu:Pro:FIPS-updates:20.04:LTS linux-aws-fips 0 5.4.0-1021.21+fips2
Ubuntu:Pro:FIPS-updates:20.04:LTS linux-azure-fips 0 5.4.0-1022.22+fips1
Ubuntu:Pro:FIPS-updates:20.04:LTS linux-fips 0 5.4.0-1026.30
Ubuntu:Pro:FIPS-updates:20.04:LTS linux-gcp-fips 0 5.4.0-1021.21+fips1
Ubuntu:Pro:FIPS-updates:22.04:LTS linux-aws-fips 0 5.15.0-1052.57+fips1
Ubuntu:Pro:FIPS-updates:22.04:LTS linux-azure-fips 0 5.15.0-1058.66+fips1
Ubuntu:Pro:FIPS-updates:22.04:LTS linux-fips 0 5.15.0-92.102+fips1
Ubuntu:Pro:FIPS-updates:22.04:LTS linux-gcp-fips 0 5.15.0-1048.56+fips1

Related vulnerabilities