CVE-2023-53169

published 2025-09-15

CVE-2023-53169: In the Linux kernel, the following vulnerability has been resolved: x86/resctrl: Clear staged_config[] before and after it is used As a temporary storage…

Priority P4 21 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

x86/resctrl: Clear staged_config[] before and after it is used

As a temporary storage, staged_config[] in rdt_domain should be cleared
before and after it is used. The stale value in staged_config[] could
cause an MSR access error.

Here is a reproducer on a system with 16 usable CLOSIDs for a 15-way L3
Cache (MBA should be disabled if the number of CLOSIDs for MB is less than
16.) :
mount -t resctrl resctrl -o cdp /sys/fs/resctrl
mkdir /sys/fs/resctrl/p{1..7}
umount /sys/fs/resctrl/
mount -t resctrl resctrl /sys/fs/resctrl
mkdir /sys/fs/resctrl/p{1..8}

An error occurs when creating resource group named p8:
unchecked MSR access error: WRMSR to 0xca0 (tried to write 0x00000000000007ff) at rIP: 0xffffffff82249142 (cat_wrmsr+0x32/0x60)
Call Trace:

__flush_smp_call_function_queue+0x11d/0x170
__sysvec_call_function+0x24/0xd0
sysvec_call_function+0x89/0xc0

asm_sysvec_call_function+0x16/0x20

When creating a new resource control group, hardware will be configured
by the following process:
rdtgroup_mkdir()
rdtgroup_mkdir_ctrl_mon()
rdtgroup_init_alloc()
resctrl_arch_update_domains()

resctrl_arch_update_domains() iterates and updates all resctrl_conf_type
whose have_new_ctrl is true. Since staged_config[] holds the same values as
when CDP was enabled, it will continue to update the CDP_CODE and CDP_DATA
configurations. When group p8 is created, get_config_index() called in
resctrl_arch_update_domains() will return 16 and 17 as the CLOSIDs for
CDP_CODE and CDP_DATA, which will be translated to an invalid register -
0xca0 in this scenario.

Fix it by clearing staged_config[] before and after it is used.

[reinette: re-order commit tags]

Affected

13 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.25-1 (bookworm)	linux 6.1.25-1 (bookworm)
linux	linux	—	—
linux	linux	>= 75408e43509ed6207870c0e7e28656acbbc1f7fd < 86db319d25db70cf4af4557e05f6fa6f39c70003	86db319d25db70cf4af4557e05f6fa6f39c70003
linux	linux	>= 75408e43509ed6207870c0e7e28656acbbc1f7fd < 3fc5941ecc31a495b6b84b465f36155009db99b5	3fc5941ecc31a495b6b84b465f36155009db99b5
linux	linux	>= 75408e43509ed6207870c0e7e28656acbbc1f7fd < 8ecc60ef9318f0d533b866fa421858cc185bccfc	8ecc60ef9318f0d533b866fa421858cc185bccfc
linux	linux	>= 75408e43509ed6207870c0e7e28656acbbc1f7fd < 0424a7dfe9129b93f29b277511a60e87f052ac6b	0424a7dfe9129b93f29b277511a60e87f052ac6b
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.1.25-1	6.1.25-1
linux	linux_kernel	>= 0 < 6.1.25-1	6.1.25-1
linux	linux_kernel	>= 0 < 6.1.25-1	6.1.25-1
linux	linux_kernel	>= 5.15 < 5.15.104	5.15.104
linux	linux_kernel	>= 5.16 < 6.1.21	6.1.21
linux	linux_kernel	>= 6.2 < 6.2.8	6.2.8

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-459