CVE-2023-52568
published 2024-03-02CVE-2023-52568: In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race The SGX EPC reclaimer (ksgxd)…
PriorityP416medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.22%
13.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race
The SGX EPC reclaimer (ksgxd) may reclaim the SECS EPC page for an
enclave and set secs.epc_page to NULL. The SECS page is used for EAUG
and ELDU in the SGX page fault handler. However, the NULL check for
secs.epc_page is only done for ELDU, not EAUG before being used.
Fix this by doing the same NULL check and reloading of the SECS page as
needed for both EAUG and ELDU.
The SECS page holds global enclave metadata. It can only be reclaimed
when there are no other enclave pages remaining. At that point,
virtually nothing can be done with the enclave until the SECS page is
paged back in.
An enclave can not run nor generate page faults without a resident SECS
page. But it is still possible for a #PF for a non-SECS page to race
with paging out the SECS page: when the last resident non-SECS page A
triggers a #PF in a non-resident page B, and then page A and the SECS
both are paged out before the #PF on B is handled.
Hitting this bug requires that race triggered with a #PF for EAUG.
Following is a trace when it happens.
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: 0010:sgx_encl_eaug_page+0xc7/0x210
Call Trace:
? __kmem_cache_alloc_node+0x16a/0x440
? xa_load+0x6e/0xa0
sgx_vma_fault+0x119/0x230
__do_fault+0x36/0x140
do_fault+0x12f/0x400
__handle_mm_fault+0x728/0x1110
handle_mm_fault+0x105/0x310
do_user_addr_fault+0x1ee/0x750
? __this_cpu_preempt_check+0x13/0x20
exc_page_fault+0x76/0x180
asm_exc_page_fault+0x27/0x30
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.64-1 (bookworm) | linux 6.1.64-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 5a90d2c3f5ef87717e54572af8426aba6fdbdaa6 < 811ba2ef0cb6402672e64ba1419d6ef95aa3405d | 811ba2ef0cb6402672e64ba1419d6ef95aa3405d |
| linux | linux | >= 5a90d2c3f5ef87717e54572af8426aba6fdbdaa6 < 1348f7f15d7c7798456856bee74a4235c2da994e | 1348f7f15d7c7798456856bee74a4235c2da994e |
| linux | linux | >= 5a90d2c3f5ef87717e54572af8426aba6fdbdaa6 < c6c2adcba50c2622ed25ba5d5e7f05f584711358 | c6c2adcba50c2622ed25ba5d5e7f05f584711358 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.1.64-1 | 6.1.64-1 |
| linux | linux_kernel | >= 0 < 6.5.6-1 | 6.5.6-1 |
| linux | linux_kernel | >= 0 < 6.5.6-1 | 6.5.6-1 |
| linux | linux_kernel | >= 6.0 < 6.1.56 | 6.1.56 |
| linux | linux_kernel | >= 6.2 < 6.5.6 | 6.5.6 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: x86/sgx: SECS reclaim vs. page fault for EAUG race
vendor_redhat·2024-03-02·CVSS 4.7
CVE-2023-52568 [MEDIUM] CWE-476 kernel: x86/sgx: SECS reclaim vs. page fault for EAUG race
kernel: x86/sgx: SECS reclaim vs. page fault for EAUG race
In the Linux kernel, the following vulnerability has been resolved:
x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race
The SGX EPC reclaimer (ksgxd) may reclaim the SECS EPC page for an
enclave and set secs.epc_page to NULL. The SECS page is used for EAUG
and ELDU in the SGX page fault handler. However, the NULL check for
secs.epc_page is only done for ELDU, not EAUG before being used.
Fix this by doing the same NULL check and reloading of the SECS page as
needed for both EAUG and ELDU.
The SECS page holds global enclave metadata. It can only be reclaimed
when there are no other enclave pages remaining. At that point,
virtually nothing can be done with the enclave until the SECS page is
paged back in.
An enclave can not r
Debian
CVE-2023-52568: linux - In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Re...
vendor_debian·2023·CVSS 4.7
CVE-2023-52568 [MEDIUM] CVE-2023-52568: linux - In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Re...
In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race The SGX EPC reclaimer (ksgxd) may reclaim the SECS EPC page for an enclave and set secs.epc_page to NULL. The SECS page is used for EAUG and ELDU in the SGX page fault handler. However, the NULL check for secs.epc_page is only done for ELDU, not EAUG before being used. Fix this by doing the same NULL check and reloading of the SECS page as needed for both EAUG and ELDU. The SECS page holds global enclave metadata. It can only be reclaimed when there are no other enclave pages remaining. At that point, virtually nothing can be done with the enclave until the SECS page is paged back in. An enclave can not run nor generate page faults without a resident SECS page. Bu
GHSA
GHSA-mxqg-3qg8-9qfj: In the Linux kernel, the following vulnerability has been resolved:
x86/sgx: Resolves SECS reclaim vs
ghsa_unreviewed·2024-03-03
CVE-2023-52568 [MEDIUM] CWE-476 GHSA-mxqg-3qg8-9qfj: In the Linux kernel, the following vulnerability has been resolved:
x86/sgx: Resolves SECS reclaim vs
In the Linux kernel, the following vulnerability has been resolved:
x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race
The SGX EPC reclaimer (ksgxd) may reclaim the SECS EPC page for an
enclave and set secs.epc_page to NULL. The SECS page is used for EAUG
and ELDU in the SGX page fault handler. However, the NULL check for
secs.epc_page is only done for ELDU, not EAUG before being used.
Fix this by doing the same NULL check and reloading of the SECS page as
needed for both EAUG and ELDU.
The SECS page holds global enclave metadata. It can only be reclaimed
when there are no other enclave pages remaining. At that point,
virtually nothing can be done with the enclave until the SECS page is
paged back in.
An enclave can not run nor generate page faults without a resident SECS
pag
OSV
CVE-2023-52568: In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Resolves SECS reclaim vs
osv·2024-03-02·CVSS 4.7
CVE-2023-52568 [MEDIUM] CVE-2023-52568: In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Resolves SECS reclaim vs
In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race The SGX EPC reclaimer (ksgxd) may reclaim the SECS EPC page for an enclave and set secs.epc_page to NULL. The SECS page is used for EAUG and ELDU in the SGX page fault handler. However, the NULL check for secs.epc_page is only done for ELDU, not EAUG before being used. Fix this by doing the same NULL check and reloading of the SECS page as needed for both EAUG and ELDU. The SECS page holds global enclave metadata. It can only be reclaimed when there are no other enclave pages remaining. At that point, virtually nothing can be done with the enclave until the SECS page is paged back in. An enclave can not run nor generate page faults without a resident SECS page. Bu
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1348f7f15d7c7798456856bee74a4235c2da994ehttps://git.kernel.org/stable/c/811ba2ef0cb6402672e64ba1419d6ef95aa3405dhttps://git.kernel.org/stable/c/c6c2adcba50c2622ed25ba5d5e7f05f584711358https://git.kernel.org/stable/c/1348f7f15d7c7798456856bee74a4235c2da994ehttps://git.kernel.org/stable/c/811ba2ef0cb6402672e64ba1419d6ef95aa3405dhttps://git.kernel.org/stable/c/c6c2adcba50c2622ed25ba5d5e7f05f584711358
2024-03-02
Published