linux-cve-announce - CVE-2023-53259: VMCI: check context->notify_page after call to get_user_pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091503-CVE-2023-53259-5409@gregkh>
Date: Mon, 15 Sep 2025 16:46:34 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53259: VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF

The call to get_user_pages_fast() in vmci_host_setup_notify() can return
NULL context->notify_page causing a GPF. To avoid GPF check if
context->notify_page == NULL and return error if so.

general protection fault, probably for non-canonical address
    0xe0009d1000000060: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x0005088000000300-
    0x0005088000000307]
CPU: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1
Hardware name: Red Hat KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014
RIP: 0010:vmci_ctx_check_signal_notify+0x91/0xe0
Call Trace:
 <TASK>
 vmci_host_unlocked_ioctl+0x362/0x1f40
 __x64_sys_ioctl+0x1a1/0x230
 do_syscall_64+0x3a/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The Linux kernel CVE team has assigned CVE-2023-53259 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.0 with commit a1d88436d53a75e950db15834b3d2f8c0c358fdc and fixed in 5.4.296 with commit b4239bfb260d1e6837766c41a0b241d7670f1402
	Issue introduced in 4.0 with commit a1d88436d53a75e950db15834b3d2f8c0c358fdc and fixed in 5.10.240 with commit d4198f67e7556b1507f14f60d81a72660e5560e4
	Issue introduced in 4.0 with commit a1d88436d53a75e950db15834b3d2f8c0c358fdc and fixed in 5.15.99 with commit a3c89e8c69a58f62451c0a75b77fcab25979b897
	Issue introduced in 4.0 with commit a1d88436d53a75e950db15834b3d2f8c0c358fdc and fixed in 6.1.16 with commit 055891397f530f9b1b22be38d7eca8b08382941f
	Issue introduced in 4.0 with commit a1d88436d53a75e950db15834b3d2f8c0c358fdc and fixed in 6.2.3 with commit 91b8e4f61f8f4594ee65368c8d89e6fdc29d3fb1
	Issue introduced in 4.0 with commit a1d88436d53a75e950db15834b3d2f8c0c358fdc and fixed in 6.3 with commit 1a726cb47fd204109c767409fa9ca15a96328f14

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53259
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/misc/vmw_vmci/vmci_host.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b4239bfb260d1e6837766c41a0b241d7670f1402
	https://git.kernel.org/stable/c/d4198f67e7556b1507f14f60d81a72660e5560e4
	https://git.kernel.org/stable/c/a3c89e8c69a58f62451c0a75b77fcab25979b897
	https://git.kernel.org/stable/c/055891397f530f9b1b22be38d7eca8b08382941f
	https://git.kernel.org/stable/c/91b8e4f61f8f4594ee65368c8d89e6fdc29d3fb1
	https://git.kernel.org/stable/c/1a726cb47fd204109c767409fa9ca15a96328f14