CVE-2023-53694

Vulnerability

In the Linux kernel, the RISC-V ftrace implementation uses an AUIPC + JALR pair to encode a jump for function tracing, which requires patching two instructions. This patching is not atomic; if kernel preemption is enabled, a task may be switched out after executing the AUIPC instruction but before the JALR instruction is reached. If the ftrace function is patched in the meantime (e.g., via dynamic ftrace updates), the JALR will target an incorrect address because the upper bits of the original address are combined with the lower bits of the new address, leading to an arbitrary jump [1].

Exploitation

The attack surface requires the ability to trigger preemption during a window when ftrace is being patched. This can occur in normal kernel operation if preemption is enabled. An unprivileged user may not directly exploit this unless they can cause a context switch at the precise moment of patching. However, the vulnerability can be triggered by system-level operations that update ftrace hooks, such as enabling/disabling tracepoints or function tracers.

Impact

If exploited, the incorrect jump can cause the kernel to execute arbitrary code or crash, resulting in a denial of service (kernel panic). The vulnerability is classified with a CVSS score that reflects high availability impact but no confidentiality or integrity impact, as the primary outcome is system instability.

Mitigation

The issue was fixed in a stable kernel commit [1]. The fix involves disabling preemption during the patching sequence to ensure atomicity of the AUIPC+JALR update. Users should apply the latest stable kernel updates that include this commit to prevent the race condition.