CVE-2023-52476 (GCVE-0-2023-52476)

Vulnerability from cvelistv5 – Published: 2024-02-29 05:43 – Updated: 2026-01-05 10:16
VLAI?
Title
perf/x86/lbr: Filter vsyscall addresses
Summary
In the Linux kernel, the following vulnerability has been resolved: perf/x86/lbr: Filter vsyscall addresses We found that a panic can occur when a vsyscall is made while LBR sampling is active. If the vsyscall is interrupted (NMI) for perf sampling, this call sequence can occur (most recent at top): __insn_get_emulate_prefix() insn_get_emulate_prefix() insn_get_prefixes() insn_get_opcode() decode_branch_type() get_branch_type() intel_pmu_lbr_filter() intel_pmu_handle_irq() perf_event_nmi_handler() Within __insn_get_emulate_prefix() at frame 0, a macro is called: peek_nbyte_next(insn_byte_t, insn, i) Within this macro, this dereference occurs: (insn)->next_byte Inspecting registers at this point, the value of the next_byte field is the address of the vsyscall made, for example the location of the vsyscall version of gettimeofday() at 0xffffffffff600000. The access to an address in the vsyscall region will trigger an oops due to an unhandled page fault. To fix the bug, filtering for vsyscalls can be done when determining the branch type. This patch will return a "none" branch if a kernel address if found to lie in the vsyscall region.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 808b64565b028bd072c985624d5cbe4b6f5a5a35 , < 3863989497652488a50f00e96de4331e5efabc6c (git)
Affected: 808b64565b028bd072c985624d5cbe4b6f5a5a35 , < f71edacbd4f99c0e12fe4a4007ab4d687d0688db (git)
Affected: 808b64565b028bd072c985624d5cbe4b6f5a5a35 , < e53899771a02f798d436655efbd9d4b46c0f9265 (git)
Create a notification for this product.
    Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 6.1.59 , ≤ 6.1.* (semver)
Unaffected: 6.5.8 , ≤ 6.5.* (semver)
Unaffected: 6.6 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52476",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-06T16:50:56.571680Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:23:20.136Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:19.936Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/403d201d1fd144cb249836dafb222f6375871c6c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3863989497652488a50f00e96de4331e5efabc6c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f71edacbd4f99c0e12fe4a4007ab4d687d0688db"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e53899771a02f798d436655efbd9d4b46c0f9265"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/events/utils.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3863989497652488a50f00e96de4331e5efabc6c",
              "status": "affected",
              "version": "808b64565b028bd072c985624d5cbe4b6f5a5a35",
              "versionType": "git"
            },
            {
              "lessThan": "f71edacbd4f99c0e12fe4a4007ab4d687d0688db",
              "status": "affected",
              "version": "808b64565b028bd072c985624d5cbe4b6f5a5a35",
              "versionType": "git"
            },
            {
              "lessThan": "e53899771a02f798d436655efbd9d4b46c0f9265",
              "status": "affected",
              "version": "808b64565b028bd072c985624d5cbe4b6f5a5a35",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/events/utils.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.59",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.8",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/lbr: Filter vsyscall addresses\n\nWe found that a panic can occur when a vsyscall is made while LBR sampling\nis active. If the vsyscall is interrupted (NMI) for perf sampling, this\ncall sequence can occur (most recent at top):\n\n    __insn_get_emulate_prefix()\n    insn_get_emulate_prefix()\n    insn_get_prefixes()\n    insn_get_opcode()\n    decode_branch_type()\n    get_branch_type()\n    intel_pmu_lbr_filter()\n    intel_pmu_handle_irq()\n    perf_event_nmi_handler()\n\nWithin __insn_get_emulate_prefix() at frame 0, a macro is called:\n\n    peek_nbyte_next(insn_byte_t, insn, i)\n\nWithin this macro, this dereference occurs:\n\n    (insn)-\u003enext_byte\n\nInspecting registers at this point, the value of the next_byte field is the\naddress of the vsyscall made, for example the location of the vsyscall\nversion of gettimeofday() at 0xffffffffff600000. The access to an address\nin the vsyscall region will trigger an oops due to an unhandled page fault.\n\nTo fix the bug, filtering for vsyscalls can be done when\ndetermining the branch type. This patch will return\na \"none\" branch if a kernel address if found to lie in the\nvsyscall region."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-05T10:16:09.447Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3863989497652488a50f00e96de4331e5efabc6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f71edacbd4f99c0e12fe4a4007ab4d687d0688db"
        },
        {
          "url": "https://git.kernel.org/stable/c/e53899771a02f798d436655efbd9d4b46c0f9265"
        }
      ],
      "title": "perf/x86/lbr: Filter vsyscall addresses",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52476",
    "datePublished": "2024-02-29T05:43:09.475Z",
    "dateReserved": "2024-02-20T12:30:33.298Z",
    "dateUpdated": "2026-01-05T10:16:09.447Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/403d201d1fd144cb249836dafb222f6375871c6c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3863989497652488a50f00e96de4331e5efabc6c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f71edacbd4f99c0e12fe4a4007ab4d687d0688db\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e53899771a02f798d436655efbd9d4b46c0f9265\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:03:19.936Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52476\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-03-06T16:50:56.571680Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:13.584Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"perf/x86/lbr: Filter vsyscall addresses\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"808b64565b028bd072c985624d5cbe4b6f5a5a35\", \"lessThan\": \"3863989497652488a50f00e96de4331e5efabc6c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"808b64565b028bd072c985624d5cbe4b6f5a5a35\", \"lessThan\": \"f71edacbd4f99c0e12fe4a4007ab4d687d0688db\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"808b64565b028bd072c985624d5cbe4b6f5a5a35\", \"lessThan\": \"e53899771a02f798d436655efbd9d4b46c0f9265\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/x86/events/utils.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.16\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.16\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.59\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.5.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.5.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/x86/events/utils.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3863989497652488a50f00e96de4331e5efabc6c\"}, {\"url\": \"https://git.kernel.org/stable/c/f71edacbd4f99c0e12fe4a4007ab4d687d0688db\"}, {\"url\": \"https://git.kernel.org/stable/c/e53899771a02f798d436655efbd9d4b46c0f9265\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf/x86/lbr: Filter vsyscall addresses\\n\\nWe found that a panic can occur when a vsyscall is made while LBR sampling\\nis active. If the vsyscall is interrupted (NMI) for perf sampling, this\\ncall sequence can occur (most recent at top):\\n\\n    __insn_get_emulate_prefix()\\n    insn_get_emulate_prefix()\\n    insn_get_prefixes()\\n    insn_get_opcode()\\n    decode_branch_type()\\n    get_branch_type()\\n    intel_pmu_lbr_filter()\\n    intel_pmu_handle_irq()\\n    perf_event_nmi_handler()\\n\\nWithin __insn_get_emulate_prefix() at frame 0, a macro is called:\\n\\n    peek_nbyte_next(insn_byte_t, insn, i)\\n\\nWithin this macro, this dereference occurs:\\n\\n    (insn)-\u003enext_byte\\n\\nInspecting registers at this point, the value of the next_byte field is the\\naddress of the vsyscall made, for example the location of the vsyscall\\nversion of gettimeofday() at 0xffffffffff600000. The access to an address\\nin the vsyscall region will trigger an oops due to an unhandled page fault.\\n\\nTo fix the bug, filtering for vsyscalls can be done when\\ndetermining the branch type. This patch will return\\na \\\"none\\\" branch if a kernel address if found to lie in the\\nvsyscall region.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.59\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.5.8\", \"versionStartIncluding\": \"5.16\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6\", \"versionStartIncluding\": \"5.16\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-01-05T10:16:09.447Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52476\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-05T10:16:09.447Z\", \"dateReserved\": \"2024-02-20T12:30:33.298Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-02-29T05:43:09.475Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.