CVE-2023-53699

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

riscv: move memblock_allow_resize() after linear mapping is ready

The initial memblock metadata is accessed from kernel image mapping. The

regions arrays need to "reallocated" from memblock and accessed through

linear mapping to cover more memblock regions. So the resizing should

not be allowed until linear mapping is ready. Note that there are

memblock allocations when building linear mapping.

This patch is similar to 24cc61d8cb5a ("arm64: memblock: don't permit

memblock resizing until linear mapping is up").

In following log, many memblock regions are reserved before

create_linear_mapping_page_table(). And then it triggered reallocation

of memblock.reserved.regions and memcpy the old array in kernel image

mapping to the new array in linear mapping which caused a page fault.

[ 0.000000] memblock_reserve: [0x00000000bf01f000-0x00000000bf01ffff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6

[ 0.000000] membloc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References