linux-cve-announce - CVE-2023-53487: powerpc/rtas_flash: allow user copy to flash block cache objects

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025100115-CVE-2023-53487-c3f7@gregkh>
Date: Wed,  1 Oct 2025 13:42:57 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53487: powerpc/rtas_flash: allow user copy to flash block cache objects

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

powerpc/rtas_flash: allow user copy to flash block cache objects

With hardened usercopy enabled (CONFIG_HARDENED_USERCOPY=y), using the
/proc/powerpc/rtas/firmware_update interface to prepare a system
firmware update yields a BUG():

  kernel BUG at mm/usercopy.c:102!
  Oops: Exception in kernel mode, sig: 5 [#1]
  LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
  Modules linked in:
  CPU: 0 PID: 2232 Comm: dd Not tainted 6.5.0-rc3+ #2
  Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 of:IBM,FW860.50 (SV860_146) hv:phyp pSeries
  NIP:  c0000000005991d0 LR: c0000000005991cc CTR: 0000000000000000
  REGS: c0000000148c76a0 TRAP: 0700   Not tainted  (6.5.0-rc3+)
  MSR:  8000000000029033 <SF,EE,ME,IR,DR,RI,LE>  CR: 24002242  XER: 0000000c
  CFAR: c0000000001fbd34 IRQMASK: 0
  [ ... GPRs omitted ... ]
  NIP usercopy_abort+0xa0/0xb0
  LR  usercopy_abort+0x9c/0xb0
  Call Trace:
    usercopy_abort+0x9c/0xb0 (unreliable)
    __check_heap_object+0x1b4/0x1d0
    __check_object_size+0x2d0/0x380
    rtas_flash_write+0xe4/0x250
    proc_reg_write+0xfc/0x160
    vfs_write+0xfc/0x4e0
    ksys_write+0x90/0x160
    system_call_exception+0x178/0x320
    system_call_common+0x160/0x2c4

The blocks of the firmware image are copied directly from user memory
to objects allocated from flash_block_cache, so flash_block_cache must
be created using kmem_cache_create_usercopy() to mark it safe for user
access.

[mpe: Trim and indent oops]

The Linux kernel CVE team has assigned CVE-2023-53487 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.16 with commit 6d07d1cd300f4c7e16005f881fea388164999cc8 and fixed in 4.19.293 with commit 8f09cc15dcd91d16562400c51d24c7be0d5796fa
	Issue introduced in 4.16 with commit 6d07d1cd300f4c7e16005f881fea388164999cc8 and fixed in 5.4.255 with commit 1d29e21ed09fa668416fa7721e08d451b9903485
	Issue introduced in 4.16 with commit 6d07d1cd300f4c7e16005f881fea388164999cc8 and fixed in 5.10.192 with commit 0ba7f969be599e21d4b1f1e947593de6515f4996
	Issue introduced in 4.16 with commit 6d07d1cd300f4c7e16005f881fea388164999cc8 and fixed in 5.15.128 with commit 8ef25fb13494e35c6dbe15445c7875fa92bc3e8b
	Issue introduced in 4.16 with commit 6d07d1cd300f4c7e16005f881fea388164999cc8 and fixed in 6.1.47 with commit b8fee83aa4ed3846c7f50a0b364bc699f48d96e5
	Issue introduced in 4.16 with commit 6d07d1cd300f4c7e16005f881fea388164999cc8 and fixed in 6.4.12 with commit 6acb8a453388374fafb3c3b37534b675b2aa0ae1
	Issue introduced in 4.16 with commit 6d07d1cd300f4c7e16005f881fea388164999cc8 and fixed in 6.5 with commit 4f3175979e62de3b929bfa54a0db4b87d36257a7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53487
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/powerpc/kernel/rtas_flash.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8f09cc15dcd91d16562400c51d24c7be0d5796fa
	https://git.kernel.org/stable/c/1d29e21ed09fa668416fa7721e08d451b9903485
	https://git.kernel.org/stable/c/0ba7f969be599e21d4b1f1e947593de6515f4996
	https://git.kernel.org/stable/c/8ef25fb13494e35c6dbe15445c7875fa92bc3e8b
	https://git.kernel.org/stable/c/b8fee83aa4ed3846c7f50a0b364bc699f48d96e5
	https://git.kernel.org/stable/c/6acb8a453388374fafb3c3b37534b675b2aa0ae1
	https://git.kernel.org/stable/c/4f3175979e62de3b929bfa54a0db4b87d36257a7