« Volver al listado

CVE-2023-52993

Estado: ModificadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL

Baoquan reported that after triggering a crash the subsequent crash-kernel fails to boot about half of the time. It triggers a NULL pointer dereference in the periodic tick code.

This happens because the legacy timer interrupt (IRQ0) is resent in software which happens in soft interrupt (tasklet) context. In this context get_irq_regs() returns NULL which leads to the NULL pointer dereference.

The reason for the resend is a spurious APIC interrupt on the IRQ0 vector which is captured and leads to a resend when the legacy timer interrupt is enabled.

Leer descripción completaMostrar menos

This is wrong because the legacy PIC interrupts are level triggered and therefore should never be resent in software, but nothing ever sets the IRQ_LEVEL flag on those interrupts, so the core code does not know about their trigger type.

Ensure that IRQ_LEVEL is set when the legacy PCI interrupts are set up.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-52993",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-52993",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-10-01T20:08:16.903596Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "a4633adcdbc15ac51afcd0e1395de58cee27cf92",
              "lessThan": "744fe9be9665227335539b7a77ece8d9ff62b6c0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a4633adcdbc15ac51afcd0e1395de58cee27cf92",
              "lessThan": "496975d1a2937f4baadf3d985991b13fc4fc4f27",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a4633adcdbc15ac51afcd0e1395de58cee27cf92",
              "lessThan": "8770cd9d7c14aa99c255a0d08186f0be953e1638",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a4633adcdbc15ac51afcd0e1395de58cee27cf92",
              "lessThan": "e284c273dbb4c1ed68d4204bff94d0b10e4a90f5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a4633adcdbc15ac51afcd0e1395de58cee27cf92",
              "lessThan": "0b08201158f177aab469e356b4d6af24fdd118df",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a4633adcdbc15ac51afcd0e1395de58cee27cf92",
              "lessThan": "137f1b47da5f58805da42c1b7811e28c1e353f39",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a4633adcdbc15ac51afcd0e1395de58cee27cf92",
              "lessThan": "5fa55950729d0762a787451dc52862c3f850f859",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "arch/x86/kernel/i8259.c",
            "arch/x86/kernel/irqinit.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.18"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.18",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.14.305",
              "versionType": "semver",
              "lessThanOrEqual": "4.14.*"
            },
            {
              "status": "unaffected",
              "version": "4.19.272",
              "versionType": "semver",
              "lessThanOrEqual": "4.19.*"
            },
            {
              "status": "unaffected",
              "version": "5.4.231",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.166",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.91",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.9",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "arch/x86/kernel/i8259.c",
            "arch/x86/kernel/irqinit.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-03-27T17:15:46.820",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0b08201158f177aab469e356b4d6af24fdd118df",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/137f1b47da5f58805da42c1b7811e28c1e353f39",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/496975d1a2937f4baadf3d985991b13fc4fc4f27",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5fa55950729d0762a787451dc52862c3f850f859",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/744fe9be9665227335539b7a77ece8d9ff62b6c0",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8770cd9d7c14aa99c255a0d08186f0be953e1638",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e284c273dbb4c1ed68d4204bff94d0b10e4a90f5",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL\n\nBaoquan reported that after triggering a crash the subsequent crash-kernel\nfails to boot about half of the time. It triggers a NULL pointer\ndereference in the periodic tick code.\n\nThis happens because the legacy timer interrupt (IRQ0) is resent in\nsoftware which happens in soft interrupt (tasklet) context. In this context\nget_irq_regs() returns NULL which leads to the NULL pointer dereference.\n\nThe reason for the resend is a spurious APIC interrupt on the IRQ0 vector\nwhich is captured and leads to a resend when the legacy timer interrupt is\nenabled. This is wrong because the legacy PIC interrupts are level\ntriggered and therefore should never be resent in software, but nothing\never sets the IRQ_LEVEL flag on those interrupts, so the core code does not\nknow about their trigger type.\n\nEnsure that IRQ_LEVEL is set when the legacy PCI interrupts are set up."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/i8259: Marcar interrupciones PIC heredadas con IRQ_LEVEL. Baoquan informó que, tras desencadenar un fallo, el kernel posterior al fallo no arranca aproximadamente la mitad de las veces. Esto desencadena una desreferencia de puntero NULL en el código de tick periódico. Esto sucede porque la interrupción del temporizador heredada (IRQ0) se reenvía por software, lo que ocurre en el contexto de una interrupción suave (tasklet). En este contexto, get_irq_regs() devuelve NULL, lo que provoca la desreferencia de puntero NULL. El motivo del reenvío es una interrupción APIC espuria en el vector IRQ0, que se captura y provoca un reenvío cuando se habilita la interrupción del temporizador heredada. Esto es incorrecto porque las interrupciones PIC heredadas se activan por nivel y, por lo tanto, nunca deberían reenviarse por software; sin embargo, nada activa el indicador IRQ_LEVEL en esas interrupciones, por lo que el código principal desconoce su tipo de activación. Asegúrese de que IRQ_LEVEL esté activado al configurar las interrupciones PCI heredadas."
    }
  ],
  "lastModified": "2026-06-17T06:44:04.497",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64C30AE2-3CFF-4B10-825A-85D7F3A4EF6F",
              "versionEndExcluding": "4.14.305",
              "versionStartIncluding": "2.6.18"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83C4B95C-BD08-4683-A26E-2A65333F2D15",
              "versionEndExcluding": "4.19.272",
              "versionStartIncluding": "4.15"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79CA608C-BC5E-4BB5-9250-771AEC44F412",
              "versionEndExcluding": "5.4.231",
              "versionStartIncluding": "4.20"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A44D9D24-661C-40D4-8735-4CEB1C7C02F2",
              "versionEndExcluding": "5.10.166",
              "versionStartIncluding": "5.5"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91C2E92D-CC25-4FBD-8824-56A148119D7E",
              "versionEndExcluding": "5.15.91",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED5B6045-B1D2-4E03-B194-9005A351BCAE",
              "versionEndExcluding": "6.1.9",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A127C155-689C-4F67-B146-44A57F4BFD85"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D34127CC-68F5-4703-A5F6-5006F803E4AE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}