CVE-2023-54267

Vulnerability

Description

The vulnerability is in the Linux kernel's powerpc/pseries code. The function lppaca_shared_proc() takes a pointer to the lppaca structure, typically obtained via get_lppaca(). When DEBUG_PREEMPT is enabled, using smp_processor_id() inside this function triggers a preemption check warning, resulting in a kernel splat. This is a false positive because the shared processor state is the same regardless of which lppaca is accessed.

Exploitation

Context

The attack surface is a local user accessing the /proc/powerpc/lparcfg file, which invokes the lparcfg_data function and triggers the splat. No special privileges are required beyond local access. This is not a security vulnerability that leads to privilege escalation or remote code execution, but it causes a denial-of-service-like kernel warning message.

Impact

The impact is limited to a kernel warning (a BUG splat) that can fill logs and potentially disrupt operation if monitored. There is no evidence of memory corruption or system compromise. The bug primarily affects systems running kernels with DEBUG_PREEMPT enabled, typically for debugging purposes.

Mitigation

The fix reworks lppaca_shared_proc() to directly access the lppaca without taking a pointer, bypassing the preemption checks. The patch has been applied to the stable kernel trees (commits [1] and [2]). Users should update to a patched kernel version.