CVE-2023-53487

What it actually does

The rtas_flash_write path performs a direct user-to-kernel copy into objects allocated from flash_block_cache without marking the cache as usercopy-safe via kmem_cache_create_usercopy, triggering a hardened usercopy BUG when CONFIG_HARDENED_USERCOPY is enabled.

Why it matters to the business

PowerPC systems performing firmware updates via the rtas interface experience immediate kernel crashes, halting maintenance operations and requiring reboots; impact is limited to specific IBM hardware running affected kernels.

How an attack unfolds

An attacker with write access to /proc/powerpc/rtas/firmware_update writes firmware image data; the kernel calls rtas_flash_write which invokes __check_object_size on the unannotated cache, hitting usercopy_abort and producing a kernel BUG/oops.

How to fix it

Upgrade to a fixed kernel containing commit 8f09cc15dcd91d16562400c51d24c7be0d5796fa or Debian linux packages version 5.8.7-1 and later; rebuild any custom kernels with the corrected kmem_cache_create_usercopy call for flash_block_cache.

How to confirm the fix worked

Confirm kernel version includes the fix commit; verify source contains kmem_cache_create_usercopy for flash_block_cache; attempt a firmware_update write on a test system and ensure no usercopy BUG occurs.

Typical attack path

1. Locate a vulnerable PowerPC Linux system with CONFIG_HARDENED_USERCOPY=y
2. Obtain write access to /proc/powerpc/rtas/firmware_update (typically root)
3. Issue a write of firmware blocks to trigger rtas_flash_write
4. Trigger __check_object_size failure leading to kernel BUG and panic

How to detect it

Search kernel logs for oops/Bug messages referencing usercopy_abort, __check_object_size, rtas_flash_write, or mm/usercopy.c; inspect processes writing to /proc/powerpc/rtas/firmware_update around the time of crashes.

• usercopy_abort+0xa0/0xb0
• rtas_flash_write+0xe4/0x250
• kernel BUG at mm/usercopy.c:102
• /proc/powerpc/rtas/firmware_update

What your security team should do

• Prioritize kernel package upgrades on all PowerPC systems within the next maintenance window
• Restrict access to /proc/powerpc/rtas/firmware_update via file permissions or SELinux policies until patched
• Monitor for kernel oops entries containing usercopy_abort and rtas_flash_write