CVE-2023-52504

x86/alternatives: Disable KASAN in apply_alternatives()

State: Published
Severity: Not scored
Published: Mar 2, 2024
Updated: May 11, 2026
Reserved: Feb 20, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

x86/alternatives: Disable KASAN in apply_alternatives()

Fei has reported that KASAN triggers during apply_alternatives() on a 5-level paging machine:

BUG: KASAN: out-of-bounds in rcu_is_watching() Read of size 4 at addr ff110003ee6419a0 by task swapper/0/0 ... __asan_load4() rcu_is_watching() trace_hardirqs_on() text_poke_early() apply_alternatives() ...

On machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57) gets patched. It includes KASAN code, where KASAN_SHADOW_START depends on __VIRTUAL_MASK_SHIFT, which is defined with cpu_feature_enabled().

KASAN gets confused when apply_alternatives() patches the KASAN_SHADOW_START users. A test patch that makes KASAN_SHADOW_START static, by replacing __VIRTUAL_MASK_SHIFT with 56, works around the issue.

Fix it for real by disabling KASAN while the kernel is patching alternatives.

[ mingo: updated the changelog ]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	6657fca06e3ffab8d0b3f9d8b397f5ee498952d7 to before 3719d3c36aa853d5a2401af9f8d6b116c91ad5aeAffected 6657fca06e3ffab8d0b3f9d8b397f5ee498952d7 to before 3770c38cd6a60494da29ac2da73ff8156440a2d1Affected 6657fca06e3ffab8d0b3f9d8b397f5ee498952d7 to before 6788b10620ca6e98575d1e06e72a8974aad7657eAffected 6657fca06e3ffab8d0b3f9d8b397f5ee498952d7 to before ecba5afe86f30605eb9dfb7f265a8de0218d4cfcAffected 6657fca06e3ffab8d0b3f9d8b397f5ee498952d7 to before 5b784489c8158518bf7a466bb3cc045b0fb66b4bAffected 6657fca06e3ffab8d0b3f9d8b397f5ee498952d7 to before cd287cc208dfe6bd6da98e7f88e723209242c9b4Affected 6657fca06e3ffab8d0b3f9d8b397f5ee498952d7 to before d35652a5fc9944784f6f50a5c979518ff8dacf61Affected
LinuxLinux	4.17Affected before 4.17Not affected 4.19.297 through 4.19.Not affected 5.4.270 through 5.4.Not affected 5.10.199 through 5.10.Not affected 5.15.136 through 5.15.Not affected 6.1.59 through 6.1.Not affected 6.5.8 through 6.5.Not affected 6.6 and laterNot affected

Product

Versions

LinuxLinux

6657fca06e3ffab8d0b3f9d8b397f5ee498952d7 to before 3719d3c36aa853d5a2401af9f8d6b116c91ad5aeAffected
6657fca06e3ffab8d0b3f9d8b397f5ee498952d7 to before 3770c38cd6a60494da29ac2da73ff8156440a2d1Affected
6657fca06e3ffab8d0b3f9d8b397f5ee498952d7 to before 6788b10620ca6e98575d1e06e72a8974aad7657eAffected
6657fca06e3ffab8d0b3f9d8b397f5ee498952d7 to before ecba5afe86f30605eb9dfb7f265a8de0218d4cfcAffected
6657fca06e3ffab8d0b3f9d8b397f5ee498952d7 to before 5b784489c8158518bf7a466bb3cc045b0fb66b4bAffected
6657fca06e3ffab8d0b3f9d8b397f5ee498952d7 to before cd287cc208dfe6bd6da98e7f88e723209242c9b4Affected
6657fca06e3ffab8d0b3f9d8b397f5ee498952d7 to before d35652a5fc9944784f6f50a5c979518ff8dacf61Affected

LinuxLinux

4.17Affected
before 4.17Not affected
4.19.297 through 4.19.*Not affected
5.4.270 through 5.4.*Not affected
5.10.199 through 5.10.*Not affected
5.15.136 through 5.15.*Not affected
6.1.59 through 6.1.*Not affected
6.5.8 through 6.5.*Not affected
6.6 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.