CVE-2023-52608 (GCVE-0-2023-52608)

Vulnerability from cvelistv5 – Published: 2024-03-13 14:01 – Updated: 2025-05-04 07:39
VLAI?
Title
firmware: arm_scmi: Check mailbox/SMT channel for consistency
Summary
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Check mailbox/SMT channel for consistency On reception of a completion interrupt the shared memory area is accessed to retrieve the message header at first and then, if the message sequence number identifies a transaction which is still pending, the related payload is fetched too. When an SCMI command times out the channel ownership remains with the platform until eventually a late reply is received and, as a consequence, any further transmission attempt remains pending, waiting for the channel to be relinquished by the platform. Once that late reply is received the channel ownership is given back to the agent and any pending request is then allowed to proceed and overwrite the SMT area of the just delivered late reply; then the wait for the reply to the new request starts. It has been observed that the spurious IRQ related to the late reply can be wrongly associated with the freshly enqueued request: when that happens the SCMI stack in-flight lookup procedure is fooled by the fact that the message header now present in the SMT area is related to the new pending transaction, even though the real reply has still to arrive. This race-condition on the A2P channel can be detected by looking at the channel status bits: a genuine reply from the platform will have set the channel free bit before triggering the completion IRQ. Add a consistency check to validate such condition in the A2P ISR.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 5c8a47a5a91d4d6e185f758d61997613d9c5d6ac , < 614cc65032dcb0b64d23f5c5e338a8a04b12be5d (git)
Affected: 5c8a47a5a91d4d6e185f758d61997613d9c5d6ac , < 7f95f6997f4fdd17abec3200cae45420a5489350 (git)
Affected: 5c8a47a5a91d4d6e185f758d61997613d9c5d6ac , < 9b5e1b93c83ee5fc9f5d7bd2d45b421bd87774a2 (git)
Affected: 5c8a47a5a91d4d6e185f758d61997613d9c5d6ac , < 12dc4217f16551d6dee9cbefc23fdb5659558cda (git)
Affected: 5c8a47a5a91d4d6e185f758d61997613d9c5d6ac , < 437a310b22244d4e0b78665c3042e5d1c0f45306 (git)
Create a notification for this product.
    Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 5.15.149 , ≤ 5.15.* (semver)
Unaffected: 6.1.76 , ≤ 6.1.* (semver)
Unaffected: 6.6.15 , ≤ 6.6.* (semver)
Unaffected: 6.7.3 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52608",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-06T17:50:57.700750Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-06T17:51:11.177Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:21.210Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/614cc65032dcb0b64d23f5c5e338a8a04b12be5d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7f95f6997f4fdd17abec3200cae45420a5489350"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9b5e1b93c83ee5fc9f5d7bd2d45b421bd87774a2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/12dc4217f16551d6dee9cbefc23fdb5659558cda"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/437a310b22244d4e0b78665c3042e5d1c0f45306"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/arm_scmi/common.h",
            "drivers/firmware/arm_scmi/mailbox.c",
            "drivers/firmware/arm_scmi/shmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "614cc65032dcb0b64d23f5c5e338a8a04b12be5d",
              "status": "affected",
              "version": "5c8a47a5a91d4d6e185f758d61997613d9c5d6ac",
              "versionType": "git"
            },
            {
              "lessThan": "7f95f6997f4fdd17abec3200cae45420a5489350",
              "status": "affected",
              "version": "5c8a47a5a91d4d6e185f758d61997613d9c5d6ac",
              "versionType": "git"
            },
            {
              "lessThan": "9b5e1b93c83ee5fc9f5d7bd2d45b421bd87774a2",
              "status": "affected",
              "version": "5c8a47a5a91d4d6e185f758d61997613d9c5d6ac",
              "versionType": "git"
            },
            {
              "lessThan": "12dc4217f16551d6dee9cbefc23fdb5659558cda",
              "status": "affected",
              "version": "5c8a47a5a91d4d6e185f758d61997613d9c5d6ac",
              "versionType": "git"
            },
            {
              "lessThan": "437a310b22244d4e0b78665c3042e5d1c0f45306",
              "status": "affected",
              "version": "5c8a47a5a91d4d6e185f758d61997613d9c5d6ac",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/arm_scmi/common.h",
            "drivers/firmware/arm_scmi/mailbox.c",
            "drivers/firmware/arm_scmi/shmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.149",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.76",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.15",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.3",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Check mailbox/SMT channel for consistency\n\nOn reception of a completion interrupt the shared memory area is accessed\nto retrieve the message header at first and then, if the message sequence\nnumber identifies a transaction which is still pending, the related\npayload is fetched too.\n\nWhen an SCMI command times out the channel ownership remains with the\nplatform until eventually a late reply is received and, as a consequence,\nany further transmission attempt remains pending, waiting for the channel\nto be relinquished by the platform.\n\nOnce that late reply is received the channel ownership is given back\nto the agent and any pending request is then allowed to proceed and\noverwrite the SMT area of the just delivered late reply; then the wait\nfor the reply to the new request starts.\n\nIt has been observed that the spurious IRQ related to the late reply can\nbe wrongly associated with the freshly enqueued request: when that happens\nthe SCMI stack in-flight lookup procedure is fooled by the fact that the\nmessage header now present in the SMT area is related to the new pending\ntransaction, even though the real reply has still to arrive.\n\nThis race-condition on the A2P channel can be detected by looking at the\nchannel status bits: a genuine reply from the platform will have set the\nchannel free bit before triggering the completion IRQ.\n\nAdd a consistency check to validate such condition in the A2P ISR."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:39:47.368Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/614cc65032dcb0b64d23f5c5e338a8a04b12be5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f95f6997f4fdd17abec3200cae45420a5489350"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b5e1b93c83ee5fc9f5d7bd2d45b421bd87774a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/12dc4217f16551d6dee9cbefc23fdb5659558cda"
        },
        {
          "url": "https://git.kernel.org/stable/c/437a310b22244d4e0b78665c3042e5d1c0f45306"
        }
      ],
      "title": "firmware: arm_scmi: Check mailbox/SMT channel for consistency",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52608",
    "datePublished": "2024-03-13T14:01:48.870Z",
    "dateReserved": "2024-03-02T21:55:42.574Z",
    "dateUpdated": "2025-05-04T07:39:47.368Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/614cc65032dcb0b64d23f5c5e338a8a04b12be5d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7f95f6997f4fdd17abec3200cae45420a5489350\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9b5e1b93c83ee5fc9f5d7bd2d45b421bd87774a2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/12dc4217f16551d6dee9cbefc23fdb5659558cda\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/437a310b22244d4e0b78665c3042e5d1c0f45306\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:03:21.210Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52608\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-06T17:50:57.700750Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-06T17:51:05.894Z\"}}], \"cna\": {\"title\": \"firmware: arm_scmi: Check mailbox/SMT channel for consistency\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5c8a47a5a91d4d6e185f758d61997613d9c5d6ac\", \"lessThan\": \"614cc65032dcb0b64d23f5c5e338a8a04b12be5d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5c8a47a5a91d4d6e185f758d61997613d9c5d6ac\", \"lessThan\": \"7f95f6997f4fdd17abec3200cae45420a5489350\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5c8a47a5a91d4d6e185f758d61997613d9c5d6ac\", \"lessThan\": \"9b5e1b93c83ee5fc9f5d7bd2d45b421bd87774a2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5c8a47a5a91d4d6e185f758d61997613d9c5d6ac\", \"lessThan\": \"12dc4217f16551d6dee9cbefc23fdb5659558cda\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5c8a47a5a91d4d6e185f758d61997613d9c5d6ac\", \"lessThan\": \"437a310b22244d4e0b78665c3042e5d1c0f45306\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/firmware/arm_scmi/common.h\", \"drivers/firmware/arm_scmi/mailbox.c\", \"drivers/firmware/arm_scmi/shmem.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.149\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.76\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.15\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/firmware/arm_scmi/common.h\", \"drivers/firmware/arm_scmi/mailbox.c\", \"drivers/firmware/arm_scmi/shmem.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/614cc65032dcb0b64d23f5c5e338a8a04b12be5d\"}, {\"url\": \"https://git.kernel.org/stable/c/7f95f6997f4fdd17abec3200cae45420a5489350\"}, {\"url\": \"https://git.kernel.org/stable/c/9b5e1b93c83ee5fc9f5d7bd2d45b421bd87774a2\"}, {\"url\": \"https://git.kernel.org/stable/c/12dc4217f16551d6dee9cbefc23fdb5659558cda\"}, {\"url\": \"https://git.kernel.org/stable/c/437a310b22244d4e0b78665c3042e5d1c0f45306\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfirmware: arm_scmi: Check mailbox/SMT channel for consistency\\n\\nOn reception of a completion interrupt the shared memory area is accessed\\nto retrieve the message header at first and then, if the message sequence\\nnumber identifies a transaction which is still pending, the related\\npayload is fetched too.\\n\\nWhen an SCMI command times out the channel ownership remains with the\\nplatform until eventually a late reply is received and, as a consequence,\\nany further transmission attempt remains pending, waiting for the channel\\nto be relinquished by the platform.\\n\\nOnce that late reply is received the channel ownership is given back\\nto the agent and any pending request is then allowed to proceed and\\noverwrite the SMT area of the just delivered late reply; then the wait\\nfor the reply to the new request starts.\\n\\nIt has been observed that the spurious IRQ related to the late reply can\\nbe wrongly associated with the freshly enqueued request: when that happens\\nthe SCMI stack in-flight lookup procedure is fooled by the fact that the\\nmessage header now present in the SMT area is related to the new pending\\ntransaction, even though the real reply has still to arrive.\\n\\nThis race-condition on the A2P channel can be detected by looking at the\\nchannel status bits: a genuine reply from the platform will have set the\\nchannel free bit before triggering the completion IRQ.\\n\\nAdd a consistency check to validate such condition in the A2P ISR.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.149\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.76\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.15\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.3\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"5.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T07:39:47.368Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52608\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T07:39:47.368Z\", \"dateReserved\": \"2024-03-02T21:55:42.574Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-03-13T14:01:48.870Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.