Linux kernel arm64: vector length change allocates SVE state with the old length, undersizing the buffer

CVSS 7.8CVE-2023-53184Kernel, userspace & hypervisorcurated

Impact

Changing a task's vector length reallocated the SVE state buffer before the new length was written to the task struct, so the allocation was sized from the old length and later writes ran past the end of an undersized kernel buffer. The maintainer notes this triggered reliably once merged to mainline. Consequences are kernel heap corruption from an unprivileged local call, which is a plausible privilege-escalation primitive and an easy panic. Relevant to arm64 GPU nodes - Grace-class and other Arm server hosts - where any tenant process can set its own vector length through prctl; the SME-specific paths need an SME-capable CPU, but the SVE path does not.

Who can reach it

Local, unprivileged: any process on an arm64 host that can call prctl to change its SVE (or SME) vector length. No authentication beyond having code execution on the node, so a tenant container reaches it directly. x86_64 hosts are unaffected.

What to do

Update to a fixed stable kernel for your series (6.1.42/6.4.7 and later per the record) and reboot each affected arm64 node. There is no userspace mitigation short of preventing vector length changes, so plan a drain-and-reboot pass across the Arm part of the fleet; x86_64 nodes need no action.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-53184 https://git.kernel.org/stable/c/807ada0e4aa3c9090c66009a99fa530c462012c9 https://git.kernel.org/stable/c/356e711640aea6ed145da9407499388b45264cb4

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.