GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2023-54267

Vulnerability from fkie_nvd - Published: 2025-12-30 13:16 - Updated: 2026-06-17 06:47
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT lppaca_shared_proc() takes a pointer to the lppaca which is typically accessed through get_lppaca(). With DEBUG_PREEMPT enabled, this leads to checking if preemption is enabled, for example: BUG: using smp_processor_id() in preemptible [00000000] code: grep/10693 caller is lparcfg_data+0x408/0x19a0 CPU: 4 PID: 10693 Comm: grep Not tainted 6.5.0-rc3 #2 Call Trace: dump_stack_lvl+0x154/0x200 (unreliable) check_preemption_disabled+0x214/0x220 lparcfg_data+0x408/0x19a0 ... This isn't actually a problem however, as it does not matter which lppaca is accessed, the shared proc state will be the same. vcpudispatch_stats_procfs_init() already works around this by disabling preemption, but the lparcfg code does not, erroring any time /proc/powerpc/lparcfg is accessed with DEBUG_PREEMPT enabled. Instead of disabling preemption on the caller side, rework lppaca_shared_proc() to not take a pointer and instead directly access the lppaca, bypassing any potential preemption checks. [mpe: Rework to avoid needing a definition in paca.h and lppaca.h]
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2935443dc9c28499223d8c881474259e4b998f2a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3c5e8e666794d7dde6d14ea846c6c04f2bb34900
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4c8568cf4c45b415854195c8832b557cdefba57a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/953c54dfdc5d3eb7243ed902b50acb5ea1db4355
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/eac030b22ea12cdfcbb2e941c21c03964403c63f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f45ee5c074013a0fbfce77a5af5efddb01f5d4f4
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/include/asm/lppaca.h",
            "arch/powerpc/platforms/pseries/lpar.c",
            "arch/powerpc/platforms/pseries/lparcfg.c",
            "arch/powerpc/platforms/pseries/setup.c",
            "drivers/cpuidle/cpuidle-pseries.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "953c54dfdc5d3eb7243ed902b50acb5ea1db4355",
              "status": "affected",
              "version": "f13c13a005127b5dc5daaca190277a062d946e63",
              "versionType": "git"
            },
            {
              "lessThan": "2935443dc9c28499223d8c881474259e4b998f2a",
              "status": "affected",
              "version": "f13c13a005127b5dc5daaca190277a062d946e63",
              "versionType": "git"
            },
            {
              "lessThan": "4c8568cf4c45b415854195c8832b557cdefba57a",
              "status": "affected",
              "version": "f13c13a005127b5dc5daaca190277a062d946e63",
              "versionType": "git"
            },
            {
              "lessThan": "3c5e8e666794d7dde6d14ea846c6c04f2bb34900",
              "status": "affected",
              "version": "f13c13a005127b5dc5daaca190277a062d946e63",
              "versionType": "git"
            },
            {
              "lessThan": "f45ee5c074013a0fbfce77a5af5efddb01f5d4f4",
              "status": "affected",
              "version": "f13c13a005127b5dc5daaca190277a062d946e63",
              "versionType": "git"
            },
            {
              "lessThan": "eac030b22ea12cdfcbb2e941c21c03964403c63f",
              "status": "affected",
              "version": "f13c13a005127b5dc5daaca190277a062d946e63",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/include/asm/lppaca.h",
            "arch/powerpc/platforms/pseries/lpar.c",
            "arch/powerpc/platforms/pseries/lparcfg.c",
            "arch/powerpc/platforms/pseries/setup.c",
            "drivers/cpuidle/cpuidle-pseries.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.195",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT\n\nlppaca_shared_proc() takes a pointer to the lppaca which is typically\naccessed through get_lppaca().  With DEBUG_PREEMPT enabled, this leads\nto checking if preemption is enabled, for example:\n\n  BUG: using smp_processor_id() in preemptible [00000000] code: grep/10693\n  caller is lparcfg_data+0x408/0x19a0\n  CPU: 4 PID: 10693 Comm: grep Not tainted 6.5.0-rc3 #2\n  Call Trace:\n    dump_stack_lvl+0x154/0x200 (unreliable)\n    check_preemption_disabled+0x214/0x220\n    lparcfg_data+0x408/0x19a0\n    ...\n\nThis isn\u0027t actually a problem however, as it does not matter which\nlppaca is accessed, the shared proc state will be the same.\nvcpudispatch_stats_procfs_init() already works around this by disabling\npreemption, but the lparcfg code does not, erroring any time\n/proc/powerpc/lparcfg is accessed with DEBUG_PREEMPT enabled.\n\nInstead of disabling preemption on the caller side, rework\nlppaca_shared_proc() to not take a pointer and instead directly access\nthe lppaca, bypassing any potential preemption checks.\n\n[mpe: Rework to avoid needing a definition in paca.h and lppaca.h]"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\npowerpc/pseries: Reestructurar lppaca_shared_proc() para evitar DEBUG_PREEMPT\n\nlppaca_shared_proc() toma un puntero al lppaca al que se accede t\u00edpicamente a trav\u00e9s de get_lppaca(). Con DEBUG_PREEMPT habilitado, esto lleva a verificar si la preemptibilidad est\u00e1 habilitada, por ejemplo:\n\n  BUG: usando smp_processor_id() en c\u00f3digo preemptible [00000000]: grep/10693\n  el llamador es lparcfg_data+0x408/0x19a0\n  CPU: 4 PID: 10693 Comm: grep No contaminado 6.5.0-rc3 #2\n  Traza de Llamadas:\n    dump_stack_lvl+0x154/0x200 (no fiable)\n    check_preemption_disabled+0x214/0x220\n    lparcfg_data+0x408/0x19a0\n    ...\n\nEsto no es realmente un problema, sin embargo, ya que no importa qu\u00e9 lppaca se acceda, el estado compartido del proceso ser\u00e1 el mismo. vcpudispatch_stats_procfs_init() ya soluciona esto deshabilitando la preemptibilidad, pero el c\u00f3digo lparcfg no lo hace, generando un error cada vez que se accede a /proc/powerpc/lparcfg con DEBUG_PREEMPT habilitado.\n\nEn lugar de deshabilitar la preemptibilidad en el lado del llamador, reestructurar lppaca_shared_proc() para que no tome un puntero y en su lugar acceda directamente al lppaca, evitando cualquier posible verificaci\u00f3n de preemptibilidad.\n\n[mpe: Reestructurar para evitar la necesidad de una definici\u00f3n en paca.h y lppaca.h]"
    }
  ],
  "id": "CVE-2023-54267",
  "lastModified": "2026-06-17T06:47:07.517",
  "metrics": {},
  "published": "2025-12-30T13:16:15.517",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2935443dc9c28499223d8c881474259e4b998f2a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3c5e8e666794d7dde6d14ea846c6c04f2bb34900"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4c8568cf4c45b415854195c8832b557cdefba57a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/953c54dfdc5d3eb7243ed902b50acb5ea1db4355"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/eac030b22ea12cdfcbb2e941c21c03964403c63f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f45ee5c074013a0fbfce77a5af5efddb01f5d4f4"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.