{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-54092", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T13:02:52.516Z", "datePublished": "2025-12-24T13:06:21.092Z", "dateUpdated": "2026-08-05T09:17:10.381Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:17:10.381Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pv: fix index value of replaced ASCE\n\nThe index field of the struct page corresponding to a guest ASCE should\nbe 0. When replacing the ASCE in s390_replace_asce(), the index of the\nnew ASCE should also be set to 0.\n\nHaving the wrong index might lead to the wrong addresses being passed\naround when notifying pte invalidations, and eventually to validity\nintercepts (VM crash) if the prefix gets unmapped and the notifier gets\ncalled with the wrong address." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is entered through the local KVM_S390_PV_COMMAND ioctl on /dev/kvm (KVM_PV_ASYNC_CLEANUP_PREPARE) or the PV deinit path, requiring local access to the host; alternatively it is driven by a hosted guest rebooting out of secure mode. There is no network-facing entry point.\nAC:L - The attacker owning the VM controls every relevant precondition — the guest size that selects a segment-type ASCE, the timing and repetition of the secure-to-normal teardown, and page-allocator grooming that determines the stale page->index handed back by alloc_pages. Repeated reboot/teardown cycles let the attacker retry freely, so no condition lies outside the attacker's influence.\nPR:L - Triggering requires only the ability to open /dev/kvm and create/run a protected VM, which is granted to ordinary unprivileged accounts (kvm group / VMM service user) rather than real root; the same path is reachable by an already-running guest that reboots.\nUI:N - No victim action is needed — the guest reboot or the ioctl sequence issued by the attacker's own VMM drives the whole sequence automatically.\nS:C - The defect is in host kernel gmap/KVM code but its effects land across the guest/host virtualization boundary: missed prefix notifications crash the guest VM, and the mis-addressed IDTE leaves guest TLB translations alive for host pages the host has already unmapped, giving the guest reach outside its assigned memory.\nC:H - Because __pmdp_idte() purges the TLB for the wrong guest address while the pmd entry is cleared, the guest retains a valid stale translation to a host page that is subsequently freed and reallocated, allowing it to read arbitrary reused host memory.\nI:H - The same stale translation is writable, so the guest can corrupt host memory that has been recycled for other purposes; in addition, corrupted gaddr values drive DAT-table invalidation and gmap pmd bookkeeping with attacker-influenced wrong addresses.\nA:H - The commit itself states the wrong index leads to validity intercepts and a VM crash when the prefix is unmapped and the notifier is called with the wrong address, and the condition can be re-triggered on every teardown cycle." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/s390/mm/gmap.c" ], "versions": [ { "version": "9d216035d173214cd33712d67d89220ef2283ebf", "lessThan": "8e635da0e0d3cb45e32fa79b36218fb98281bc10", "status": "affected", "versionType": "git" }, { "version": "81ea65c9aefe100a9ace3082649bd84ae7dd9764", "lessThan": "49a2686adddebe1ae76b4d368383208656ef6606", "status": "affected", "versionType": "git" }, { "version": "faa2f72cb3569256480c5540d242c84e99965160", "lessThan": "017f686bcb536ff23d49c143fdf9d1fd89a9a924", "status": "affected", "versionType": "git" }, { "version": "faa2f72cb3569256480c5540d242c84e99965160", "lessThan": "f1c7a776338f2ac5e34da40e58fe9f33ea390a5e", "status": "affected", "versionType": "git" }, { "version": "faa2f72cb3569256480c5540d242c84e99965160", "lessThan": "c2fceb59bbda16468bda82b002383bff59de89ab", "status": "affected", "versionType": "git" }, { "version": "b5477f53e1d4de6191f50748a027251b14952eeb", "status": "affected", "versionType": "git" }, { "version": "63c71e83d5b6ab8adb5fcebef977052048016957", "status": "affected", "versionType": "git" }, { "version": "5.10.137", "lessThan": "5.10.190", "status": "affected", "versionType": "semver" }, { "version": "5.15.61", "lessThan": "5.15.124", "status": "affected", "versionType": "semver" }, { "version": "5.18.18", "lessThan": "5.19", "status": "affected", "versionType": "semver" }, { "version": "5.19.2", "lessThan": "5.20", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/s390/mm/gmap.c" ], "versions": [ { "version": "6.0", "status": "affected" }, { "version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.190", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.124", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.43", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.4.8", "lessThanOrEqual": "6.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.5", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.137", "versionEndExcluding": "5.10.190" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.61", "versionEndExcluding": "5.15.124" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.43" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.4.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18.18" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/8e635da0e0d3cb45e32fa79b36218fb98281bc10" }, { "url": "https://git.kernel.org/stable/c/49a2686adddebe1ae76b4d368383208656ef6606" }, { "url": "https://git.kernel.org/stable/c/017f686bcb536ff23d49c143fdf9d1fd89a9a924" }, { "url": "https://git.kernel.org/stable/c/f1c7a776338f2ac5e34da40e58fe9f33ea390a5e" }, { "url": "https://git.kernel.org/stable/c/c2fceb59bbda16468bda82b002383bff59de89ab" } ], "title": "KVM: s390: pv: fix index value of replaced ASCE", "x_generator": { "engine": "bippy-1.2.0" } } } }