CyberSecBulletin
CVE-2023-52451NVD status: Modified

Linux: Improper Validation of Array Index

Published Updated By the CyberSecBulletin desk

CVE-2023-52451 is a high-severity improper validation of array index vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions bb79613a9a704469ddb8d6c6029d532a5cea384c, 9b5f03500bc5b083c0df696d7dd169d7ef3dd0c7, b582aa1f66411d4adcc1aa55b8c575683fb4687e as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to bb79613a9a704469ddb8d6c6029d532a5cea384c or 9b5f03500bc5b083c0df696d7dd169d7ef3dd0c7 or b582aa1f66411d4adcc1aa55b8c575683fb4687e or 999a27b3ce9a69d54ccd5db000ec3a447bc43e6d, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.19.306 or 5.4.268 or 5.10.209 or 5.15.148, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux51925fb3c5c901aa06cdc853268a6e19e19bcdc7 up to, but not including, bb79613a9a704469ddb8d6c6029d532a5cea384c; 51925fb3c5c901aa06cdc853268a6e19e19bcdc7 up to, but not including, 9b5f03500bc5b083c0df696d7dd169d7ef3dd0c7; 51925fb3c5c901aa06cdc853268a6e19e19bcdc7 up to, but not including, b582aa1f66411d4adcc1aa55b8c575683fb4687e; 51925fb3c5c901aa06cdc853268a6e19e19bcdc7 up to, but not including, 999a27b3ce9a69d54ccd5db000ec3a447bc43e6d; 51925fb3c5c901aa06cdc853268a6e19e19bcdc7 up to, but not including, 026fd977dc50ff4a5e09bfb0603557f104d3f3a0; 51925fb3c5c901aa06cdc853268a6e19e19bcdc7 up to, but not including, df16afba2378d985359812c865a15c05c70a967e; 51925fb3c5c901aa06cdc853268a6e19e19bcdc7 up to, but not including, 708a4b59baad96c4718dc0bd3a3427d3ab22fedc; 51925fb3c5c901aa06cdc853268a6e19e19bcdc7 up to, but not including, bd68ffce69f6cf8ddd3a3c32549d1d2275e49fc5; and 1 more rangesbb79613a9a704469ddb8d6c6029d532a5cea384c, 9b5f03500bc5b083c0df696d7dd169d7ef3dd0c7, b582aa1f66411d4adcc1aa55b8c575683fb4687e, 999a27b3ce9a69d54ccd5db000ec3a447bc43e6d, 026fd977dc50ff4a5e09bfb0603557f104d3f3a0, df16afba2378d985359812c865a15c05c70a967e
LinuxLinux Kernel4.1.0 up to, but not including, 4.19.306; 4.20.0 up to, but not including, 5.4.268; 5.5.0 up to, but not including, 5.10.209; 5.11.0 up to, but not including, 5.15.148; 5.16.0 up to, but not including, 6.1.75; 6.2.0 up to, but not including, 6.6.14; 6.7.0 up to, but not including, 6.7.24.19.306, 5.4.268, 5.10.209, 5.15.148, 6.1.75, 6.6.14

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/memhp: Fix access beyond end of drmem array dlpar_memory_remove_by_index() may access beyond the bounds of the drmem lmb array when the LMB lookup fails to match an entry with the given DRC index. When the search fails, the cursor is left pointing to &drmem_info->lmbs[drmem_info->n_lmbs], which is one element past the last valid entry in the array. The debug message at the end of the function then dereferences this pointer: pr_debug("Failed to hot-remove memory at %llx\n", lmb->base_addr); This was found by inspection and confirmed with KASAN: pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 1234 ================================================================== BUG: KASAN: slab-out-of-bounds in dlpar_memory+0x298/0x1658 Read of size 8 at addr c000000364e97fd0 by task bash/949 dump_stack_lvl+0xa4/0xfc (unreliable) print_report+0x214/0x63c kasan_report+0x140/0x2e0 __asan_load8+0xa8/0xe0 dlpar_memory+0x298/0x1658 handle_dlpar_errorlog+0x130/0x1d0 dlpar_store+0x18c/0x3e0 kobj_attr_store+0x68/0xa0 sysfs_kf_write+0xc4/0x110 kernfs_fop_write_iter+0x26c/0x390 vfs_write+0x2d4/0x4e0 ksys_write+0xac/0x1a0 system_call_exception+0x268/0x530 system_call_vectored_common+0x15c/0x2ec Allocated by task 1: kasan_save_stack+0x48/0x80 kasan_set_track+0x34/0x50 kasan_save_alloc_info+0x34/0x50 __kasan_kmalloc+0xd0/0x120 __kmalloc+0x8c/0x320 kmalloc_array.constprop.0+0x48/0x5c drmem_init+0x2a0/0x41c do_one_initcall+0xe0/0x5c0 kernel_init_freeable+0x4ec/0x5a0 kernel_init+0x30/0x1e0 ret_from_kernel_user_thread+0x14/0x1c The buggy address belongs to the object at c000000364e80000 which belongs to the cache kmalloc-128k of size 131072 The buggy address is located 0 bytes to the right of allocated 98256-byte region [c000000364e80000, c000000364e97fd0) ================================================================== pseries-hotplug-mem: Failed to hot-remove memory at 0 Log failed lookups with a separate message and dereference the cursor only when it points to a valid entry.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Validation of Array Index

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

How developers prevent this class of flaw

  • Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, Ada allows the programmer to constrain the values of a variable and languages such as Java and Ruby will allow the programmer to handle exceptions when an out-of-bounds index is accessed.
  • Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment. For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND.

More Improper Validation of Array Index vulnerabilities (CWE-129)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Validation of Array Index vulnerabilities

Spotted an error? Tell us.