Soft Lockup Vulnerability in Linux Kernel's ARM SMMU - CVE-2023-52484
Summary
CVE-2023-52484: In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range When running an SVA case, the following soft lockup is triggered: ---------... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interactions. It supports various architectures, including ARM, which is widely used in embedded systems and mobile devices. The vulnerability in question affects the ARM SMMU (System Memory Management Unit), specifically in the context of Shared Virtual Addressing (SVA) cases, where it can lead to a soft lockup, causing the CPU to become unresponsive.
Vulnerability Detail
CVE-2023-52484 is a vulnerability in the Linux kernel's ARM SMMU implementation that can trigger a soft lockup when running SVA cases. The issue arises from the improper handling of TLB (Translation Lookaside Buffer) invalidation requests, which can lead to the CPU being stuck for an extended period. The vulnerability was identified in the function arm_smmu_mm_invalidate_range, which is responsible for invalidating memory mappings. If exploited, this vulnerability can severely impact system performance and stability, potentially leading to denial of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid running SVA cases that trigger the soft lockup until the kernel is updated. Additionally, monitoring system performance and CPU usage can help identify potential lockup scenarios.
Conclusion
CVE-2023-52484 is a significant vulnerability in the Linux kernel's ARM SMMU that can lead to soft lockups, affecting system performance and stability. Users are advised to update their kernels promptly to mitigate this risk. Temporary workarounds can help manage the situation until a proper fix is applied.
See every vulnerability recorded for linux →
FAQ
CVE-2023-52484 is a vulnerability in the Linux kernel's ARM SMMU that can cause a soft lockup during SVA operations.
This vulnerability can lead to system instability and performance degradation, potentially causing the CPU to become unresponsive.
The vulnerability affects various versions of the Linux kernel, specifically those prior to the patches released in versions 6.1.64-1 and 6.5.6-1 for Debian.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If an immediate update is not possible, avoid running SVA cases that may trigger the soft lockup and monitor your system for performance issues.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
