Critical Vulnerability in Linux Kernel: LoongArch Timer IRQ Handling Issue
Summary
CVE-2023-53067: In the Linux kernel, the following vulnerability has been resolved: LoongArch: Only call get_timer_irq() once in constant_clockevent_init() Under CONFIG_DEBUG_ATOMIC_SLEEP=y and CONFIG_DEBUG_PREEMPT=y, we can see the fol... Affects linux versions < 6.1.25-1. Fixed in 6.1.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and software resources. It provides essential services for all other parts of the system, ensuring efficient operation. This vulnerability specifically affects the LoongArch architecture, which is designed for Loongson processors. The issue arises from improper handling of timer IRQs, leading to potential system instability under certain configurations.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the constant_clockevent_init() function, where get_timer_irq() is called multiple times in a preemption-disabled context. This can lead to system errors, as indicated by the debug messages generated under CONFIG_DEBUG_ATOMIC_SLEEP and CONFIG_DEBUG_PREEMPT. The improper use of might_sleep() in this context can cause the kernel to enter an invalid state, potentially leading to crashes or unexpected behavior.
How To Fix
Minimum fixed version
6.1.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid enabling CONFIG_DEBUG_ATOMIC_SLEEP and CONFIG_DEBUG_PREEMPT, which may prevent the debug messages from appearing, but this does not fix the underlying issue. It is recommended to apply the patch as soon as possible.
Conclusion
The CVE-2023-53067 vulnerability in the Linux kernel poses a significant risk to systems using the LoongArch architecture. Users are strongly advised to update their kernels to the latest patched versions to ensure system stability and security. Temporary workarounds exist, but applying the patch is the best course of action.
See every vulnerability recorded for linux →
FAQ
CVE-2023-53067 is a vulnerability in the Linux kernel affecting the LoongArch architecture, related to improper handling of timer IRQs.
This vulnerability can lead to system instability, crashes, or unexpected behavior when the kernel is operating under certain configurations.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
As a temporary measure, consider disabling CONFIG_DEBUG_ATOMIC_SLEEP and CONFIG_DEBUG_PREEMPT, but be aware that this does not resolve the vulnerability.
Detailed information can be found in the official CVE database and through the Linux kernel mailing lists and documentation.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
