CVE-2023-54232

Linux Kernel 2.6.18-6.2.8 - Denial of Service via Bus Error Exception Handling

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: m68k: Only force 030 bus error if PC not in exception table __get_kernel_nofault() does copy data in supervisor mode when forcing a task backtrace log through /proc/sysrq_trigger. This is expected cause a bus error exception on e.g. NULL pointer dereferencing when logging a kernel task has no workqueue associated. This bus error ought to be ignored. Our 030 bus error handler is ill equipped to deal with this: Whenever ssw indicates a kernel mode access on a data fault, we don't even attempt to handle the fault and instead always send a SEGV signal (or panic). As a result, the check for exception handling at the fault PC (buried in send_sig_fault() which gets called from do_page_fault() eventually) is never used. In contrast, both 040 and 060 access error handlers do not care whether a fault happened on supervisor mode access, and will call do_page_fault() on those, ultimately honoring the exception table. Add a check in bus_error030 to call do_page_fault() in case we do have an entry for the fault PC in our exception table. I had attempted a fix for this earlier in 2019 that did rely on testing pagefault_disabled() (see link below) to achieve the same thing, but this patch should be more generic. Tested on 030 Atari Falcon.

Scores

EPSS 0.0018
EPSS Percentile 8.3%

Details

Status published
Products (25)
linux/Kernel 2.6.18 - 4.14.312linux
linux/Kernel 4.15.0 - 4.19.280linux
linux/Kernel 4.20.0 - 5.4.240linux
linux/Kernel 5.11.0 - 5.15.105linux
linux/Kernel 5.16.0 - 6.1.22linux
linux/Kernel 5.5.0 - 5.10.177linux
linux/Kernel 6.2.0 - 6.2.9linux
Linux/Linux < 2.6.18
Linux/Linux 2.6.18
Linux/Linux 4.14.312 - 4.14.*
... and 15 more
Published Dec 30, 2025
Tracked Since Feb 18, 2026