linux-cve-announce - CVE-2023-53169: x86/resctrl: Clear staged

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091554-CVE-2023-53169-0678@gregkh>
Date: Mon, 15 Sep 2025 16:02:23 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53169: x86/resctrl: Clear staged_config[] before and after it is used

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

x86/resctrl: Clear staged_config[] before and after it is used

As a temporary storage, staged_config[] in rdt_domain should be cleared
before and after it is used. The stale value in staged_config[] could
cause an MSR access error.

Here is a reproducer on a system with 16 usable CLOSIDs for a 15-way L3
Cache (MBA should be disabled if the number of CLOSIDs for MB is less than
16.) :
	mount -t resctrl resctrl -o cdp /sys/fs/resctrl
	mkdir /sys/fs/resctrl/p{1..7}
	umount /sys/fs/resctrl/
	mount -t resctrl resctrl /sys/fs/resctrl
	mkdir /sys/fs/resctrl/p{1..8}

An error occurs when creating resource group named p8:
    unchecked MSR access error: WRMSR to 0xca0 (tried to write 0x00000000000007ff) at rIP: 0xffffffff82249142 (cat_wrmsr+0x32/0x60)
    Call Trace:
     <IRQ>
     __flush_smp_call_function_queue+0x11d/0x170
     __sysvec_call_function+0x24/0xd0
     sysvec_call_function+0x89/0xc0
     </IRQ>
     <TASK>
     asm_sysvec_call_function+0x16/0x20

When creating a new resource control group, hardware will be configured
by the following process:
    rdtgroup_mkdir()
      rdtgroup_mkdir_ctrl_mon()
        rdtgroup_init_alloc()
          resctrl_arch_update_domains()

resctrl_arch_update_domains() iterates and updates all resctrl_conf_type
whose have_new_ctrl is true. Since staged_config[] holds the same values as
when CDP was enabled, it will continue to update the CDP_CODE and CDP_DATA
configurations. When group p8 is created, get_config_index() called in
resctrl_arch_update_domains() will return 16 and 17 as the CLOSIDs for
CDP_CODE and CDP_DATA, which will be translated to an invalid register -
0xca0 in this scenario.

Fix it by clearing staged_config[] before and after it is used.

[reinette: re-order commit tags]

The Linux kernel CVE team has assigned CVE-2023-53169 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15 with commit 75408e43509ed6207870c0e7e28656acbbc1f7fd and fixed in 5.15.104 with commit 86db319d25db70cf4af4557e05f6fa6f39c70003
	Issue introduced in 5.15 with commit 75408e43509ed6207870c0e7e28656acbbc1f7fd and fixed in 6.1.21 with commit 3fc5941ecc31a495b6b84b465f36155009db99b5
	Issue introduced in 5.15 with commit 75408e43509ed6207870c0e7e28656acbbc1f7fd and fixed in 6.2.8 with commit 8ecc60ef9318f0d533b866fa421858cc185bccfc
	Issue introduced in 5.15 with commit 75408e43509ed6207870c0e7e28656acbbc1f7fd and fixed in 6.3 with commit 0424a7dfe9129b93f29b277511a60e87f052ac6b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53169
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/x86/kernel/cpu/resctrl/ctrlmondata.c
	arch/x86/kernel/cpu/resctrl/internal.h
	arch/x86/kernel/cpu/resctrl/rdtgroup.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/86db319d25db70cf4af4557e05f6fa6f39c70003
	https://git.kernel.org/stable/c/3fc5941ecc31a495b6b84b465f36155009db99b5
	https://git.kernel.org/stable/c/8ecc60ef9318f0d533b866fa421858cc185bccfc
	https://git.kernel.org/stable/c/0424a7dfe9129b93f29b277511a60e87f052ac6b