CVE-2023-53326

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

powerpc: Don't try to copy PPR for task with NULL pt_regs

powerpc sets up PF_KTHREAD and PF_IO_WORKER with a NULL pt_regs, which

from my (arguably very short) checking is not commonly done for other

archs. This is fine, except when PF_IO_WORKER's have been created and

the task does something that causes a coredump to be generated. Then we

get this crash:

Kernel attempted to read user page (160) - exploit attempt? (uid: 1000)

BUG: Kernel NULL pointer dereference on read at 0x00000160

Faulting instruction address: 0xc0000000000c3a60

Oops: Kernel access of bad area, sig: 11 [#1]

LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=32 NUMA pSeries

Modules linked in: bochs drm_vram_helper drm_kms_helper xts binfmt_misc ecb ctr syscopyarea sysfillrect cbc sysimgblt drm_ttm_helper aes_generic ttm sg libaes evdev joydev virtio_balloon vmx_crypto gf128mul drm dm_mod fuse loop configfs drm_panel_orientation_quirks ip_tables x_t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References