CVE-2023-54322

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

arm64: set __exception_irq_entry with __irq_entry as a default

filter_irq_stacks() is supposed to cut entries which are related irq entries

from its call stack.

And in_irqentry_text() which is called by filter_irq_stacks()

uses __irqentry_text_start/end symbol to find irq entries in callstack.

But it doesn't work correctly as without "CONFIG_FUNCTION_GRAPH_TRACER",

arm64 kernel doesn't include gic_handle_irq which is entry point of arm64 irq

between __irqentry_text_start and __irqentry_text_end as we discussed in below link.

https://lore.kernel.org/all/CACT4Y+aReMGLYua2rCLHgFpS9io5cZC04Q8GLs-uNmrn1ezxYQ@mail.gmail.com/#t

This problem can makes unintentional deep call stack entries especially

in KASAN enabled situation as below.

[ 2479.383395]I[0:launcher-loader: 1719] Stack depot reached limit capacity

[ 2479.383538]I[0:launcher-loader: 1719] WARNING: CPU: 0 PID: 1719 at lib/stackdepot.c:129 __stack_depot_save+0x4

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References