CVE-2023-53989

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

arm64: mm: fix VA-range sanity check

Both create_mapping_noalloc() and update_mapping_prot() sanity-check

their 'virt' parameter, but the check itself doesn't make much sense.

The condition used today appears to be a historical accident.

The sanity-check condition:

if ((virt >= PAGE_END) && (virt < VMALLOC_START)) {

[ ... warning here ... ]

return;

}

... can only be true for the KASAN shadow region or the module region,

and there's no reason to exclude these specifically for creating and

updateing mappings.

When arm64 support was first upstreamed in commit:

c1cc1552616d0f35 ("arm64: MMU initialisation")

... the condition was:

if (virt < VMALLOC_START) {

[ ... warning here ... ]

return;

}

At the time, VMALLOC_START was the lowest kernel address, and this was

checking whether 'virt' would be translated via TTBR1.

Subsequently in commit:

14c127c957c1c607 ("arm64: mm: Flip kernel VA space")

...

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References