CVE-2023-52780: Vulnerability in Linux Linux

Severity: highType: vulnerabilityCVE-2023-52780

In the Linux kernel, the following vulnerability has been resolved: net: mvneta: fix calls to page_pool_get_stats Calling page_pool_get_stats in the mvneta driver without checks leads to kernel crashes. First the page pool is only available if the bm is not used. The page pool is also not allocated when the port is stopped. It can also be not allocated in case of errors. The current implementation leads to the following crash calling ethstats on a port that is down or when calling it at the wrong moment: ble to handle kernel NULL pointer dereference at virtual address 00000070 [00000070] *pgd=00000000 Internal error: Oops: 5 [#1] SMP ARM Hardware name: Marvell Armada 380/385 (Device Tree) PC is at page_pool_get_stats+0x18/0x1cc LR is at mvneta_ethtool_get_stats+0xa0/0xe0 [mvneta] pc : [<c0b413cc>] lr : [<bf0a98d8>] psr: a0000013 sp : f1439d48 ip : f1439dc0 fp : 0000001d r10: 00000100 r9 : c4816b80 r8 : f0d75150 r7 : bf0b400c r6 : c238f000 r5 : 00000000 r4 : f1439d68 r3 : c2091040 r2 : ffffffd8 r1 : f1439d68 r0 : 00000000 Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 066b004a DAC: 00000051 Register r0 information: NULL pointer Register r1 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 Register r2 information: non-paged memory Register r3 information: slab kmalloc-2k start c2091000 pointer offset 64 size 2048 Register r4 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 Register r5 information: NULL pointer Register r6 information: slab kmalloc-cg-4k start c238f000 pointer offset 0 size 4096 Register r7 information: 15-page vmalloc region starting at 0xbf0a8000 allocated at load_module+0xa30/0x219c Register r8 information: 1-page vmalloc region starting at 0xf0d75000 allocated at ethtool_get_stats+0x138/0x208 Register r9 information: slab task_struct start c4816b80 pointer offset 0 Register r10 information: non-paged memory Register r11 information: non-paged memory Register r12 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 Process snmpd (pid: 733, stack limit = 0x38de3a88) Stack: (0xf1439d48 to 0xf143a000) 9d40: 000000c0 00000001 c238f000 bf0b400c f0d75150 c4816b80 9d60: 00000100 bf0a98d8 00000000 00000000 00000000 00000000 00000000 00000000 9d80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9da0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9dc0: 00000dc0 5335509c 00000035 c238f000 bf0b2214 01067f50 f0d75000 c0b9b9c8 9de0: 0000001d 00000035 c2212094 5335509c c4816b80 c238f000 c5ad6e00 01067f50 9e00: c1b0be80 c4816b80 00014813 c0b9d7f0 00000000 00000000 0000001d 0000001d 9e20: 00000000 00001200 00000000 00000000 c216ed90 c73943b8 00000000 00000000 9e40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9e60: 00000000 c0ad9034 00000000 00000000 00000000 00000000 00000000 00000000 9e80: 00000000 00000000 00000000 5335509c c1b0be80 f1439ee4 00008946 c1b0be80 9ea0: 01067f50 f1439ee3 00000000 00000046 b6d77ae0 c0b383f0 00008946 becc83e8 9ec0: c1b0be80 00000051 0000000b c68ca480 c7172d00 c0ad8ff0 f1439ee3 cf600e40 9ee0: 01600e40 32687465 00000000 00000000 00000000 01067f50 00000000 00000000 9f00: 00000000 5335509c 00008946 00008946 00000000 c68ca480 becc83e8 c05e2de0 9f20: f1439fb0 c03002f0 00000006 5ac3c35a c4816b80 00000006 b6d77ae0 c030caf0 9f40: c4817350 00000014 f1439e1c 0000000c 00000000 00000051 01000000 00000014 9f60: 00003fec f1439edc 00000001 c0372abc b6d77ae0 c0372abc cf600e40 5335509c 9f80: c21e6800 01015c9c 0000000b 00008946 00000036 c03002f0 c4816b80 00000036 9fa0: b6d77ae0 c03000c0 01015c9c 0000000b 0000000b 00008946 becc83e8 00000000 9fc0: 01015c9c 0000000b 00008946 00000036 00000035 010678a0 b6d797ec b6d77ae0 9fe0: b6dbf738 becc838c b6d186d7 b6baa858 40000030 0000000b 00000000 00000000 page_pool_get_s ---truncated---

AI Analysis

Technical Summary

CVE-2023-52780 is a vulnerability in the Linux kernel specifically affecting the mvneta network driver, which is used primarily on Marvell Armada ARM-based platforms. The issue arises from improper handling of calls to the function page_pool_get_stats within the mvneta driver. This function is intended to retrieve statistics from a page pool, but the vulnerability occurs because the driver calls page_pool_get_stats without verifying whether the page pool is allocated or available. The page pool is only allocated if the buffer manager (bm) is not used, and it is not allocated when the network port is stopped or in error conditions. Consequently, invoking ethstats on a port that is down or at an inappropriate time can lead to a NULL pointer dereference in the kernel, causing a kernel crash (kernel oops). The crash details indicate a NULL pointer dereference at a low virtual address, which is symptomatic of dereferencing an uninitialized or freed pointer. The vulnerability affects ARM-based Linux systems running the mvneta driver, which is common in embedded and network devices using Marvell Armada 380/385 SoCs. While no known exploits are currently reported in the wild, the flaw can cause denial of service (DoS) by crashing the kernel, potentially disrupting network operations and device availability. The vulnerability does not appear to allow privilege escalation or code execution but can impact system stability and availability. The patch involves adding proper checks before calling page_pool_get_stats to ensure the page pool is allocated and valid, preventing the NULL pointer dereference and subsequent crash.

Potential Impact

For European organizations, the primary impact of CVE-2023-52780 is the risk of denial of service on devices running affected Linux kernels with the mvneta driver, particularly embedded network devices and ARM-based servers or appliances. This can disrupt critical network infrastructure, especially in sectors relying on Marvell Armada-based hardware such as telecommunications, industrial control systems, and network equipment manufacturers. The kernel crashes can lead to unexpected device reboots or downtime, impacting availability of network services and potentially causing cascading failures in dependent systems. Although the vulnerability does not directly compromise confidentiality or integrity, the availability impact can be significant in environments requiring high uptime and reliability. Organizations using Linux-based network appliances or embedded systems in their infrastructure should be aware of this risk. The lack of known exploits reduces immediate threat but does not eliminate the risk, especially if attackers develop proof-of-concept exploits to trigger kernel crashes remotely or locally. The vulnerability may also affect managed service providers and cloud environments using ARM-based Linux hosts with mvneta, potentially impacting hosted services.

Mitigation Recommendations

1. Apply the official Linux kernel patches that address CVE-2023-52780 as soon as they become available from trusted sources or Linux distributions. 2. For organizations using custom or embedded Linux builds, ensure that the mvneta driver is updated to include the fix or disable the affected functionality if feasible. 3. Implement monitoring for kernel oops or crashes related to the mvneta driver to detect potential exploitation attempts or instability. 4. Limit access to management interfaces and restrict the ability to invoke ethstats or similar diagnostic commands to trusted administrators to reduce the risk of accidental or malicious triggering of the vulnerability. 5. In environments where patching is delayed, consider network segmentation or isolating affected devices to minimize impact on critical infrastructure. 6. Engage with hardware vendors and Linux distribution maintainers to confirm patch availability and deployment timelines. 7. Conduct thorough testing of updated kernels in staging environments to ensure stability before production rollout.