CVE-2023-52451

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/pseries/memhp: Fix access beyond end of drmem array

dlpar_memory_remove_by_index() may access beyond the bounds of the

drmem lmb array when the LMB lookup fails to match an entry with the

given DRC index. When the search fails, the cursor is left pointing to

&drmem_info->lmbs[drmem_info->n_lmbs], which is one element past the

last valid entry in the array. The debug message at the end of the

function then dereferences this pointer:

pr_debug("Failed to hot-remove memory at %llx\n",

lmb->base_addr);

This was found by inspection and confirmed with KASAN:

pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 1234

==================================================================

BUG: KASAN: slab-out-of-bounds in dlpar_memory+0x298/0x1658

Read of size 8 at addr c000000364e97fd0 by task bash/949

dump_stack_lvl+0xa4/0xfc (unreliable)

print_report+0x214/0x63c

kasan_re

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References