CVE-2023-54267

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT

lppaca_shared_proc() takes a pointer to the lppaca which is typically

accessed through get_lppaca(). With DEBUG_PREEMPT enabled, this leads

to checking if preemption is enabled, for example:

BUG: using smp_processor_id() in preemptible [00000000] code: grep/10693

caller is lparcfg_data+0x408/0x19a0

CPU: 4 PID: 10693 Comm: grep Not tainted 6.5.0-rc3 #2

Call Trace:

dump_stack_lvl+0x154/0x200 (unreliable)

check_preemption_disabled+0x214/0x220

lparcfg_data+0x408/0x19a0

...

This isn't actually a problem however, as it does not matter which

lppaca is accessed, the shared proc state will be the same.

vcpudispatch_stats_procfs_init() already works around this by disabling

preemption, but the lparcfg code does not, erroring any time

/proc/powerpc/lparcfg is accessed with DEBUG_PREEMPT enabled.

Instead of disabling preemption on the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References