CVE-2023-54092 (GCVE-0-2023-54092)
Vulnerability from cvelistv5
Published
2025-12-24 13:06
Modified
2026-08-05 09:17
Severity ?
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pv: fix index value of replaced ASCE The index field of the struct page corresponding to a guest ASCE should be 0. When replacing the ASCE in s390_replace_asce(), the index of the new ASCE should also be set to 0. Having the wrong index might lead to the wrong addresses being passed around when notifying pte invalidations, and eventually to validity intercepts (VM crash) if the prefix gets unmapped and the notifier gets called with the wrong address.
References
Impacted products
Vendor Product Version
Linux Linux Version: 9d216035d173214cd33712d67d89220ef2283ebf
Version: 81ea65c9aefe100a9ace3082649bd84ae7dd9764
Version: faa2f72cb3569256480c5540d242c84e99965160
Version: faa2f72cb3569256480c5540d242c84e99965160
Version: faa2f72cb3569256480c5540d242c84e99965160
Version: b5477f53e1d4de6191f50748a027251b14952eeb
Version: 63c71e83d5b6ab8adb5fcebef977052048016957
Version: 5.10.137   ≤
Version: 5.15.61   ≤
Version: 5.18.18   ≤
Version: 5.19.2   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/mm/gmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8e635da0e0d3cb45e32fa79b36218fb98281bc10",
              "status": "affected",
              "version": "9d216035d173214cd33712d67d89220ef2283ebf",
              "versionType": "git"
            },
            {
              "lessThan": "49a2686adddebe1ae76b4d368383208656ef6606",
              "status": "affected",
              "version": "81ea65c9aefe100a9ace3082649bd84ae7dd9764",
              "versionType": "git"
            },
            {
              "lessThan": "017f686bcb536ff23d49c143fdf9d1fd89a9a924",
              "status": "affected",
              "version": "faa2f72cb3569256480c5540d242c84e99965160",
              "versionType": "git"
            },
            {
              "lessThan": "f1c7a776338f2ac5e34da40e58fe9f33ea390a5e",
              "status": "affected",
              "version": "faa2f72cb3569256480c5540d242c84e99965160",
              "versionType": "git"
            },
            {
              "lessThan": "c2fceb59bbda16468bda82b002383bff59de89ab",
              "status": "affected",
              "version": "faa2f72cb3569256480c5540d242c84e99965160",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b5477f53e1d4de6191f50748a027251b14952eeb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "63c71e83d5b6ab8adb5fcebef977052048016957",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.190",
              "status": "affected",
              "version": "5.10.137",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.124",
              "status": "affected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThan": "5.20",
              "status": "affected",
              "version": "5.19.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/s390/mm/gmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.190",
                  "versionStartIncluding": "5.10.137",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.124",
                  "versionStartIncluding": "5.15.61",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.43",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.8",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.19.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pv: fix index value of replaced ASCE\n\nThe index field of the struct page corresponding to a guest ASCE should\nbe 0. When replacing the ASCE in s390_replace_asce(), the index of the\nnew ASCE should also be set to 0.\n\nHaving the wrong index might lead to the wrong addresses being passed\naround when notifying pte invalidations, and eventually to validity\nintercepts (VM crash) if the prefix gets unmapped and the notifier gets\ncalled with the wrong address."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is entered through the local KVM_S390_PV_COMMAND ioctl on /dev/kvm (KVM_PV_ASYNC_CLEANUP_PREPARE) or the PV deinit path, requiring local access to the host; alternatively it is driven by a hosted guest rebooting out of secure mode. There is no network-facing entry point.\nAC:L - The attacker owning the VM controls every relevant precondition \u2014 the guest size that selects a segment-type ASCE, the timing and repetition of the secure-to-normal teardown, and page-allocator grooming that determines the stale page-\u003eindex handed back by alloc_pages. Repeated reboot/teardown cycles let the attacker retry freely, so no condition lies outside the attacker\u0027s influence.\nPR:L - Triggering requires only the ability to open /dev/kvm and create/run a protected VM, which is granted to ordinary unprivileged accounts (kvm group / VMM service user) rather than real root; the same path is reachable by an already-running guest that reboots.\nUI:N - No victim action is needed \u2014 the guest reboot or the ioctl sequence issued by the attacker\u0027s own VMM drives the whole sequence automatically.\nS:C - The defect is in host kernel gmap/KVM code but its effects land across the guest/host virtualization boundary: missed prefix notifications crash the guest VM, and the mis-addressed IDTE leaves guest TLB translations alive for host pages the host has already unmapped, giving the guest reach outside its assigned memory.\nC:H - Because __pmdp_idte() purges the TLB for the wrong guest address while the pmd entry is cleared, the guest retains a valid stale translation to a host page that is subsequently freed and reallocated, allowing it to read arbitrary reused host memory.\nI:H - The same stale translation is writable, so the guest can corrupt host memory that has been recycled for other purposes; in addition, corrupted gaddr values drive DAT-table invalidation and gmap pmd bookkeeping with attacker-influenced wrong addresses.\nA:H - The commit itself states the wrong index leads to validity intercepts and a VM crash when the prefix is unmapped and the notifier is called with the wrong address, and the condition can be re-triggered on every teardown cycle."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:10.381Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8e635da0e0d3cb45e32fa79b36218fb98281bc10"
        },
        {
          "url": "https://git.kernel.org/stable/c/49a2686adddebe1ae76b4d368383208656ef6606"
        },
        {
          "url": "https://git.kernel.org/stable/c/017f686bcb536ff23d49c143fdf9d1fd89a9a924"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1c7a776338f2ac5e34da40e58fe9f33ea390a5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2fceb59bbda16468bda82b002383bff59de89ab"
        }
      ],
      "title": "KVM: s390: pv: fix index value of replaced ASCE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54092",
    "datePublished": "2025-12-24T13:06:21.092Z",
    "dateReserved": "2025-12-24T13:02:52.516Z",
    "dateUpdated": "2026-08-05T09:17:10.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.