CVE-2023-53647

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: vmbus: Don't dereference ACPI root object handle

Since the commit referenced in the Fixes: tag below the VMBus client driver

is walking the ACPI namespace up from the VMBus ACPI device to the ACPI

namespace root object trying to find Hyper-V MMIO ranges.

However, if it is not able to find them it ends trying to walk resources of

the ACPI namespace root object itself.

This object has all-ones handle, which causes a NULL pointer dereference

in the ACPI code (from dereferencing this pointer with an offset).

This in turn causes an oops on boot with VMBus host implementations that do

not provide Hyper-V MMIO ranges in their VMBus ACPI device or its

ancestors.

The QEMU VMBus implementation is an example of such implementation.

I guess providing these ranges is optional, since all tested Windows

versions seem to be able to use VMBus devices without them.

Fix this by explicitly terminating the lookup at the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References