linux-cve-announce - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091858-CVE-2023-53438-50e2@gregkh>
Date: Thu, 18 Sep 2025 18:04:29 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

x86/MCE: Always save CS register on AMD Zen IF Poison errors

The Instruction Fetch (IF) units on current AMD Zen-based systems do not
guarantee a synchronous #MC is delivered for poison consumption errors.
Therefore, MCG_STATUS[EIPV|RIPV] will not be set. However, the
microarchitecture does guarantee that the exception is delivered within
the same context. In other words, the exact rIP is not known, but the
context is known to not have changed.

There is no architecturally-defined method to determine this behavior.

The Code Segment (CS) register is always valid on such IF unit poison
errors regardless of the value of MCG_STATUS[EIPV|RIPV].

Add a quirk to save the CS register for poison consumption from the IF
unit banks.

This is needed to properly determine the context of the error.
Otherwise, the severity grading function will assume the context is
IN_KERNEL due to the m->cs value being 0 (the initialized value). This
leads to unnecessary kernel panics on data poison errors due to the
kernel believing the poison consumption occurred in kernel context.

The Linux kernel CVE team has assigned CVE-2023-53438 to this issue.

Affected and fixed versions
===========================

	Fixed in 6.1.53 with commit e6e6a5f50f58fadec397b23064b7e4830292863d
	Fixed in 6.4.16 with commit 6eac3965901489ae114a664a78cd2d1415d1af5c
	Fixed in 6.5.3 with commit 2e01bdf7203c383e9d8489d9f963c52d6c81e4db
	Fixed in 6.6 with commit 4240e2ebe67941ce2c4f5c866c3af4b5ac7a0c67

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53438
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	arch/x86/kernel/cpu/mce/core.c
	arch/x86/kernel/cpu/mce/internal.h

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e6e6a5f50f58fadec397b23064b7e4830292863d
	https://git.kernel.org/stable/c/6eac3965901489ae114a664a78cd2d1415d1af5c
	https://git.kernel.org/stable/c/2e01bdf7203c383e9d8489d9f963c52d6c81e4db
	https://git.kernel.org/stable/c/4240e2ebe67941ce2c4f5c866c3af4b5ac7a0c67