{"dataType":"CVE_RECORD","cveMetadata":{"cveId":"CVE-2023-52489","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-20T12:30:33.302Z","datePublished":"2024-02-29T15:52:08.718Z","dateUpdated":"2026-05-11T19:28:19.292Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-05-11T19:28:19.292Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/sparsemem: fix race in accessing memory_section->usage\n\nThe below race is observed on a PFN which falls into the device memory\nregion with the system memory configuration where PFN's are such that\n[ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL].  Since normal zone start and end\npfn contains the device memory PFN's as well, the compaction triggered\nwill try on the device memory PFN's too though they end up in NOP(because\npfn_to_online_page() returns NULL for ZONE_DEVICE memory sections).  When\nfrom other core, the section mappings are being removed for the\nZONE_DEVICE region, that the PFN in question belongs to, on which\ncompaction is currently being operated is resulting into the kernel crash\nwith CONFIG_SPASEMEM_VMEMAP enabled.  The crash logs can be seen at [1].\n\ncompact_zone()\t\t\tmemunmap_pages\n-------------\t\t\t---------------\n__pageblock_pfn_to_page\n   ......\n (a)pfn_valid():\n     valid_section()//return true\n\t\t\t      (b)__remove_pages()->\n\t\t\t\t  sparse_remove_section()->\n\t\t\t\t    section_deactivate():\n\t\t\t\t    [Free the array ms->usage and set\n\t\t\t\t     ms->usage = NULL]\n     pfn_section_valid()\n     [Access ms->usage which\n     is NULL]\n\nNOTE: From the above it can be said that the race is reduced to between\nthe pfn_valid()/pfn_section_valid() and the section deactivate with\nSPASEMEM_VMEMAP enabled.\n\nThe commit b943f045a9af(\"mm/sparse: fix kernel crash with\npfn_section_valid check\") tried to address the same problem by clearing\nthe SECTION_HAS_MEM_MAP with the expectation of valid_section() returns\nfalse thus ms->usage is not accessed.\n\nFix this issue by the below steps:\n\na) Clear SECTION_HAS_MEM_MAP before freeing the ->usage.\n\nb) RCU protected read side critical section will either return NULL\n   when SECTION_HAS_MEM_MAP is cleared or can successfully access ->usage.\n\nc) Free the ->usage with kfree_rcu() and set ms->usage = NULL.  No\n   attempt will be made to access ->usage after this as the\n   SECTION_HAS_MEM_MAP is cleared thus valid_section() return false.\n\nThanks to David/Pavan for their inputs on this patch.\n\n[1] https://lore.kernel.org/linux-mm/994410bb-89aa-d987-1f50-f514903c55aa@quicinc.com/\n\nOn Snapdragon SoC, with the mentioned memory configuration of PFN's as\n[ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL], we are able to see bunch of\nissues daily while testing on a device farm.\n\nFor this particular issue below is the log.  Though the below log is\nnot directly pointing to the pfn_section_valid(){ ms->usage;}, when we\nloaded this dump on T32 lauterbach tool, it is pointing.\n\n[  540.578056] Unable to handle kernel NULL pointer dereference at\nvirtual address 0000000000000000\n[  540.578068] Mem abort info:\n[  540.578070]   ESR = 0x0000000096000005\n[  540.578073]   EC = 0x25: DABT (current EL), IL = 32 bits\n[  540.578077]   SET = 0, FnV = 0\n[  540.578080]   EA = 0, S1PTW = 0\n[  540.578082]   FSC = 0x05: level 1 translation fault\n[  540.578085] Data abort info:\n[  540.578086]   ISV = 0, ISS = 0x00000005\n[  540.578088]   CM = 0, WnR = 0\n[  540.579431] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBSBTYPE=--)\n[  540.579436] pc : __pageblock_pfn_to_page+0x6c/0x14c\n[  540.579454] lr : compact_zone+0x994/0x1058\n[  540.579460] sp : ffffffc03579b510\n[  540.579463] x29: ffffffc03579b510 x28: 0000000000235800 x27:000000000000000c\n[  540.579470] x26: 0000000000235c00 x25: 0000000000000068 x24:ffffffc03579b640\n[  540.579477] x23: 0000000000000001 x22: ffffffc03579b660 x21:0000000000000000\n[  540.579483] x20: 0000000000235bff x19: ffffffdebf7e3940 x18:ffffffdebf66d140\n[  540.579489] x17: 00000000739ba063 x16: 00000000739ba063 x15:00000000009f4bff\n[  540.579495] x14: 0000008000000000 x13: 0000000000000000 x12:0000000000000001\n[  540.579501] x11: 0000000000000000 x10: 0000000000000000 x9 :ffffff897d2cd440\n[  540.579507] x8 : 0000000000000000 x7 : 0000000000000000 x6 :ffffffc03579b5b4\n[  540.579512] x5 : 0000000000027f25 x4 : ffffffc03579b5b8 x3 :0000000000000\n---truncated---"}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/mmzone.h","mm/sparse.c"],"versions":[{"version":"f46edbd1b1516da1fb34c917775168d5df576f78","lessThan":"90ad17575d26874287271127d43ef3c2af876cea","status":"affected","versionType":"git"},{"version":"f46edbd1b1516da1fb34c917775168d5df576f78","lessThan":"b448de2459b6d62a53892487ab18b7d823ff0529","status":"affected","versionType":"git"},{"version":"f46edbd1b1516da1fb34c917775168d5df576f78","lessThan":"68ed9e33324021e9d6b798e9db00ca3093d2012a","status":"affected","versionType":"git"},{"version":"f46edbd1b1516da1fb34c917775168d5df576f78","lessThan":"70064241f2229f7ba7b9599a98f68d9142e81a97","status":"affected","versionType":"git"},{"version":"f46edbd1b1516da1fb34c917775168d5df576f78","lessThan":"3a01daace71b521563c38bbbf874e14c3e58adb7","status":"affected","versionType":"git"},{"version":"f46edbd1b1516da1fb34c917775168d5df576f78","lessThan":"5ec8e8ea8b7783fab150cf86404fc38cb4db8800","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/mmzone.h","mm/sparse.c"],"versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","status":"unaffected","versionType":"semver"},{"version":"5.10.210","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.149","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.76","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.15","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.3","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"5.10.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"5.15.149"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.1.76"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.6.15"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.7.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3","versionEndExcluding":"6.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/90ad17575d26874287271127d43ef3c2af876cea"},{"url":"https://git.kernel.org/stable/c/b448de2459b6d62a53892487ab18b7d823ff0529"},{"url":"https://git.kernel.org/stable/c/68ed9e33324021e9d6b798e9db00ca3093d2012a"},{"url":"https://git.kernel.org/stable/c/70064241f2229f7ba7b9599a98f68d9142e81a97"},{"url":"https://git.kernel.org/stable/c/3a01daace71b521563c38bbbf874e14c3e58adb7"},{"url":"https://git.kernel.org/stable/c/5ec8e8ea8b7783fab150cf86404fc38cb4db8800"}],"title":"mm/sparsemem: fix race in accessing memory_section->usage","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2023-52489","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-03-12T14:56:15.828991Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-04T17:22:46.560Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T23:03:20.387Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/90ad17575d26874287271127d43ef3c2af876cea","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b448de2459b6d62a53892487ab18b7d823ff0529","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/68ed9e33324021e9d6b798e9db00ca3093d2012a","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/70064241f2229f7ba7b9599a98f68d9142e81a97","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/3a01daace71b521563c38bbbf874e14c3e58adb7","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/5ec8e8ea8b7783fab150cf86404fc38cb4db8800","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","tags":["x_transferred"]}]}]},"dataVersion":"5.2"}