CVE-2023-52484

一、漏洞信息
 漏洞编号：[CVE-2023-52484](https://nvd.nist.gov/vuln/detail/CVE-2023-52484)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.19,6.1.5,6.1.6,6.1.8,6.4.0
 CVSS V2.0分值：
  BaseScore：0.0 Low
  Vector：CVSS：2.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_rangeWhen running an SVA case, the following soft lockup is triggered:--------------------------------------------------------------------watchdog: BUG: soft lockup - CPU#244 stuck for 26s!pstate: 83400009 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)pc : arm_smmu_cmdq_issue_cmdlist+0x178/0xa50lr : arm_smmu_cmdq_issue_cmdlist+0x150/0xa50sp : ffff8000d83ef290x29: ffff8000d83ef290 x28: 000000003b9aca00 x27: 0000000000000000x26: ffff8000d83ef3c0 x25: da86c0812194a0e8 x24: 0000000000000000x23: 0000000000000040 x22: ffff8000d83ef340 x21: ffff0000c63980c0x20: 0000000000000001 x19: ffff0000c6398080 x18: 0000000000000000x17: 0000000000000000 x16: 0000000000000000 x15: ffff3000b4a3bbb0x14: ffff3000b4a30888 x13: ffff3000b4a3cf60 x12: 0000000000000000x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc08120e4d6bcx8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000048cfax5 : 0000000000000000 x4 : 0000000000000001 x3 : 000000000000000ax2 : 0000000080000000 x1 : 0000000000000000 x0 : 0000000000000001Call trace: arm_smmu_cmdq_issue_cmdlist+0x178/0xa50 __arm_smmu_tlb_inv_range+0x118/0x254 arm_smmu_tlb_inv_range_asid+0x6c/0x130 arm_smmu_mm_invalidate_range+0xa0/0xa4 __mmu_notifier_invalidate_range_end+0x88/0x120 unmap_vmas+0x194/0x1e0 unmap_region+0xb4/0x144 do_mas_align_munmap+0x290/0x490 do_mas_munmap+0xbc/0x124 __vm_munmap+0xa8/0x19c __arm64_sys_munmap+0x28/0x50 invoke_syscall+0x78/0x11c el0_svc_common.constprop.0+0x58/0x1c0 do_el0_svc+0x34/0x60 el0_svc+0x2c/0xd4 el0t_64_sync_handler+0x114/0x140 el0t_64_sync+0x1a4/0x1a8--------------------------------------------------------------------Note that since 6.6-rc1 the arm_smmu_mm_invalidate_range above is renamedto  arm_smmu_mm_arch_invalidate_secondary_tlbs , yet the problem remains.The commit 06ff87bae8d3 ( arm64: mm: remove unused functions and variableprotoypes ) fixed a similar lockup on the CPU MMU side. Yet, it can occurto SMMU too, since arm_smmu_mm_arch_invalidate_secondary_tlbs() is calledtypically next to MMU tlb flush function, e.g.	tlb_flush_mmu_tlbonly {		tlb_flush {			__flush_tlb_range {				// check MAX_TLBI_OPS			}		}		mmu_notifier_arch_invalidate_secondary_tlbs {			arm_smmu_mm_arch_invalidate_secondary_tlbs {				// does not check MAX_TLBI_OPS			}		}	}Clone a CMDQ_MAX_TLBI_OPS from the MAX_TLBI_OPS in tlbflush.h, since in anSVA case SMMU uses the CPU page table, so it makes sense to align with thetlbflush code. Then, replace per-page TLBI commands with a single per-asidTLBI command, if the request size hits this threshold.
 漏洞公开时间：2024-02-29 14:15
 漏洞创建时间：2024-02-29 14:28:07
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-52484
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52484 | https://bugzilla.suse.com/show_bug.cgi?id=1220797 |
| suse_bugzilla | https://git.kernel.org/stable/c/f5a604757aa8e37ea9c7011dc9da54fa1b30f29b | https://bugzilla.suse.com/show_bug.cgi?id=1220797 |
| suse_bugzilla | https://git.kernel.org/stable/c/f90f4c562003ac3d3b135c5a40a5383313f27264 | https://bugzilla.suse.com/show_bug.cgi?id=1220797 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-52484 | https://bugzilla.suse.com/show_bug.cgi?id=1220797 |
| suse_bugzilla | https://git.kernel.org/stable/c/3283a1bce9bbc978059f790b84f3c10c32492429 | https://bugzilla.suse.com/show_bug.cgi?id=1220797 |
| suse_bugzilla | https://git.kernel.org/stable/c/d5afb4b47e13161b3f33904d45110f9e6463bad6 | https://bugzilla.suse.com/show_bug.cgi?id=1220797 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2267023 | https://bugzilla.suse.com/show_bug.cgi?id=1220797 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2024022923-CVE-2023-52484-3635@gregkh/T/#u | https://bugzilla.redhat.com/show_bug.cgi?id=2267023 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52484 | https://ubuntu.com/security/CVE-2023-52484 |
| ubuntu | https://git.kernel.org/linus/d5afb4b47e13161b3f33904d45110f9e6463bad6 (6.6-rc5) | https://ubuntu.com/security/CVE-2023-52484 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2023-52484 | https://ubuntu.com/security/CVE-2023-52484 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2023-52484 | https://ubuntu.com/security/CVE-2023-52484 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2023-52484 | https://ubuntu.com/security/CVE-2023-52484 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-52484 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux |  | https://git.kernel.org/linus/d5afb4b47e13161b3f33904d45110f9e6463bad6 | https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    In the Linux kernel, the following vulnerability has been resolved:iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_rangeWhen running an SVA case, the following soft lockup is triggered:--------------------------------------------------------------------watchdog: BUG: soft lockup - CPU#244 stuck for 26s!pstate: 83400009 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)pc : arm_smmu_cmdq_issue_cmdlist+0x178/0xa50lr : arm_smmu_cmdq_issue_cmdlist+0x150/0xa50sp : ffff8000d83ef290x29: ffff8000d83ef290 x28: 000000003b9aca00 x27: 0000000000000000x26: ffff8000d83ef3c0 x25: da86c0812194a0e8 x24: 0000000000000000x23: 0000000000000040 x22: ffff8000d83ef340 x21: ffff0000c63980c0x20: 0000000000000001 x19: ffff0000c6398080 x18: 0000000000000000x17: 0000000000000000 x16: 0000000000000000 x15: ffff3000b4a3bbb0x14: ffff3000b4a30888 x13: ffff3000b4a3cf60 x12: 0000000000000000x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc08120e4d6bcx8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000048cfax5 : 0000000000000000 x4 : 0000000000000001 x3 : 000000000000000ax2 : 0000000080000000 x1 : 0000000000000000 x0 : 0000000000000001Call trace: arm_smmu_cmdq_issue_cmdlist+0x178/0xa50 __arm_smmu_tlb_inv_range+0x118/0x254 arm_smmu_tlb_inv_range_asid+0x6c/0x130 arm_smmu_mm_invalidate_range+0xa0/0xa4 __mmu_notifier_invalidate_range_end+0x88/0x120 unmap_vmas+0x194/0x1e0 unmap_region+0xb4/0x144 do_mas_align_munmap+0x290/0x490 do_mas_munmap+0xbc/0x124 __vm_munmap+0xa8/0x19c __arm64_sys_munmap+0x28/0x50 invoke_syscall+0x78/0x11c el0_svc_common.constprop.0+0x58/0x1c0 do_el0_svc+0x34/0x60 el0_svc+0x2c/0xd4 el0t_64_sync_handler+0x114/0x140 el0t_64_sync+0x1a4/0x1a8--------------------------------------------------------------------Note that since 6.6-rc1 the arm_smmu_mm_invalidate_range above is renamedto  arm_smmu_mm_arch_invalidate_secondary_tlbs , yet the problem remains.The commit 06ff87bae8d3 ( arm64: mm: remove unused functions and variableprotoypes ) fixed a similar lockup on the CPU MMU side. Yet, it can occurto SMMU too, since arm_smmu_mm_arch_invalidate_secondary_tlbs() is calledtypically next to MMU tlb flush function, e.g.tlb_flush_mmu_tlbonly {tlb_flush {__flush_tlb_range {// check MAX_TLBI_OPS}}mmu_notifier_arch_invalidate_secondary_tlbs {arm_smmu_mm_arch_invalidate_secondary_tlbs {// does not check MAX_TLBI_OPS}}}Clone a CMDQ_MAX_TLBI_OPS from the MAX_TLBI_OPS in tlbflush.h, since in anSVA case SMMU uses the CPU page table, so it makes sense to align with thetlbflush code. Then, replace per-page TLBI commands with a single per-asidTLBI command, if the request size hits this threshold. 
 openEuler评分：
  5.5
 Vector：CVSS：2.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS(5.10.0):受影响
2.openEuler-22.03-LTS-SP1(5.10.0):受影响
3.openEuler-22.03-LTS-SP2(5.10.0):受影响
4.openEuler-22.03-LTS-SP3(5.10.0):受影响
5.openEuler-20.03-LTS-SP1(4.19.90):不受影响
6.openEuler-20.03-LTS-SP4(4.19.90):不受影响
7.master(6.1.0):不受影响
8.openEuler-22.03-LTS-Next(5.10.0):不受影响
9.openEuler-24.03-LTS:不受影响
10.openEuler-24.03-LTS-Next:不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP1(4.19.90):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS(5.10.0):否
4.openEuler-22.03-LTS-SP1(5.10.0):否
5.openEuler-22.03-LTS-SP2(5.10.0):否
6.openEuler-22.03-LTS-SP3(5.10.0):否
7.master(6.1.0):否
8.openEuler-22.03-LTS-Next(5.10.0):否
9.openEuler-24.03-LTS:否
10.openEuler-24.03-LTS-Next:否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-1397

src-openEuler/kernel
Closed

Content Risk Flag

Comments (11)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2023-52484

Comments (11)

Search

src-openEuler/kernel
Closed