CVE-2023-53713

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

arm64: sme: Use STR P to clear FFR context field in streaming SVE mode

The FFR is a predicate register which can vary between 16 and 256 bits

in size depending upon the configured vector length. When saving the

SVE state in streaming SVE mode, the FFR register is inaccessible and

so commit 9f5848665788 ("arm64/sve: Make access to FFR optional") simply

clears the FFR field of the in-memory context structure. Unfortunately,

it achieves this using an unconditional 8-byte store and so if the SME

vector length is anything other than 64 bytes in size we will either

fail to clear the entire field or, worse, we will corrupt memory

immediately following the structure. This has led to intermittent kfence

splats in CI [1] and can trigger kmalloc Redzone corruption messages

when running the 'fp-stress' kselftest:

| =============================================================================

| BUG kmalloc-1k (Not tainted): km

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References