{"api_version":"1","generated_at":"2026-10-29T10:37:55+00:00","cve":"CVE-2023-54042","urls":{"html":"https://cve.report/CVE-2023-54042","api":"https://cve.report/api/cve/CVE-2023-54042.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-54042","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-54042"},"summary":{"title":"powerpc/64s: Fix VAS mm use after free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/64s: Fix VAS mm use after free\n\nThe refcount on mm is dropped before the coprocessor is detached.","state":"PUBLISHED","assigner":"Linux","published_at":"2025-12-24 11:15:57","updated_at":"2026-10-15 22:17:51"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/4e82f92c349ea603736ade1e814861c0182a55ad","name":"https://git.kernel.org/stable/c/4e82f92c349ea603736ade1e814861c0182a55ad","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/421cd1544480f2458042fe7f4913a2069c4d7251","name":"https://git.kernel.org/stable/c/421cd1544480f2458042fe7f4913a2069c4d7251","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f7d92313002b2d543500cc417d8079aaed1fb0a8","name":"https://git.kernel.org/stable/c/f7d92313002b2d543500cc417d8079aaed1fb0a8","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/db8657fdd53c5e3069149d7f957cb60e63027bb2","name":"https://git.kernel.org/stable/c/db8657fdd53c5e3069149d7f957cb60e63027bb2","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b4bda59b47879cce38a6ec5a01cd3cac702b5331","name":"https://git.kernel.org/stable/c/b4bda59b47879cce38a6ec5a01cd3cac702b5331","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-54042","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54042","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7bc6f71bdff5f8921e324da0a8fad6f4e2e63a85 f7d92313002b2d543500cc417d8079aaed1fb0a8 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7bc6f71bdff5f8921e324da0a8fad6f4e2e63a85 4e82f92c349ea603736ade1e814861c0182a55ad git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7bc6f71bdff5f8921e324da0a8fad6f4e2e63a85 db8657fdd53c5e3069149d7f957cb60e63027bb2 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7bc6f71bdff5f8921e324da0a8fad6f4e2e63a85 421cd1544480f2458042fe7f4913a2069c4d7251 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7bc6f71bdff5f8921e324da0a8fad6f4e2e63a85 b4bda59b47879cce38a6ec5a01cd3cac702b5331 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.14","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.14 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.121 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.39 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.3.13 6.3.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.4.4 6.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.5 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2023","cve_id":"54042","cve":"CVE-2023-54042","epss":"0.001400000","percentile":"0.029800000","score_date":"2026-10-15","updated_at":"2026-10-16 00:06:11"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2023-54042","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-15T21:37:58.217277Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-15T21:41:38.268Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/powerpc/platforms/powernv/vas-window.c","arch/powerpc/platforms/pseries/vas.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f7d92313002b2d543500cc417d8079aaed1fb0a8","status":"affected","version":"7bc6f71bdff5f8921e324da0a8fad6f4e2e63a85","versionType":"git"},{"lessThan":"4e82f92c349ea603736ade1e814861c0182a55ad","status":"affected","version":"7bc6f71bdff5f8921e324da0a8fad6f4e2e63a85","versionType":"git"},{"lessThan":"db8657fdd53c5e3069149d7f957cb60e63027bb2","status":"affected","version":"7bc6f71bdff5f8921e324da0a8fad6f4e2e63a85","versionType":"git"},{"lessThan":"421cd1544480f2458042fe7f4913a2069c4d7251","status":"affected","version":"7bc6f71bdff5f8921e324da0a8fad6f4e2e63a85","versionType":"git"},{"lessThan":"b4bda59b47879cce38a6ec5a01cd3cac702b5331","status":"affected","version":"7bc6f71bdff5f8921e324da0a8fad6f4e2e63a85","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/powerpc/platforms/powernv/vas-window.c","arch/powerpc/platforms/pseries/vas.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.14"},{"lessThan":"5.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.121","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.39","versionType":"semver"},{"lessThanOrEqual":"6.3.*","status":"unaffected","version":"6.3.13","versionType":"semver"},{"lessThanOrEqual":"6.4.*","status":"unaffected","version":"6.4.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.5","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.121","versionStartIncluding":"5.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.39","versionStartIncluding":"5.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.3.13","versionStartIncluding":"5.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.4.4","versionStartIncluding":"5.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.5","versionStartIncluding":"5.14","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/64s: Fix VAS mm use after free\n\nThe refcount on mm is dropped before the coprocessor is detached."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached through a local character device (`/dev/crypto/nx-gzip`) via `open()` + `ioctl(VAS_TX_WIN_OPEN)` + process exit/`close()`. No network or adjacent-network path exists to the VAS window close path.\nAC:L - The attacker fully controls the trigger: open a window and exit the process, at which point the VAS reference is deterministically the last `mm_count` reference, so `mmdrop()` frees the mm and the immediately following `mm_context_remove_vas_window()` dereferences it. No unwinnable race or uncontrollable precondition is involved, and the sequence can be repeated freely to groom `mm_cachep` reallocation.\nPR:L - Only an unprivileged local account is needed — there is no `capable()` or `CAP_*` check on any path from the ioctl to `vas_deallocate_window()`/`vas_win_close()`, and `Documentation/powerpc/vas-api.rst` states no special privileges are required to open the nx-gzip device, which is deliberately exposed to ordinary user-space compression libraries.\nUI:N - The attacking process performs every step itself (open, ioctl, exit); no action by another user or administrator is required.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The freed `mm_struct` is read after free — `context.id`, `context.copros`, `context.active_cpus`, `mm_users`, and `mm_cpumask()` — and `mm_cachep` objects are readily reallocated by forking, so the attacker can influence the contents read; a UAF of this kind is leverageable for kernel memory disclosure, and the corrupted TLB-flush scoping can leave stale translations exposing another process's memory.\nI:H - Multiple writes land in the freed object: `atomic_dec_if_positive()` on `context.copros`/`context.vas_windows`, plus cross-CPU `atomic_dec(&mm->context.active_cpus)`, `cpumask_clear_cpu()`, and a possible extra `mmdrop_lazy_tlb()` refcount underflow, giving write primitives into a reallocated live `mm_struct` (or SLUB freelist metadata) that are exploitable for further corruption.\nA:H - The use-after-free reliably corrupts freed slab memory and issues hardware TLB invalidations with a stale PID plus IPIs derived from a freed cpumask, producing oopses, `WARN_ON()` splats (fatal with `panic_on_warn`), slab corruption, and kernel panics — triggerable repeatedly by any local user."}]}],"providerMetadata":{"dateUpdated":"2026-08-05T09:16:42.390Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/f7d92313002b2d543500cc417d8079aaed1fb0a8"},{"url":"https://git.kernel.org/stable/c/4e82f92c349ea603736ade1e814861c0182a55ad"},{"url":"https://git.kernel.org/stable/c/db8657fdd53c5e3069149d7f957cb60e63027bb2"},{"url":"https://git.kernel.org/stable/c/421cd1544480f2458042fe7f4913a2069c4d7251"},{"url":"https://git.kernel.org/stable/c/b4bda59b47879cce38a6ec5a01cd3cac702b5331"}],"title":"powerpc/64s: Fix VAS mm use after free","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2023-54042","datePublished":"2025-12-24T10:56:07.565Z","dateReserved":"2025-12-24T10:53:46.181Z","dateUpdated":"2026-10-15T21:41:38.268Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-12-24 11:15:57","lastModifiedDate":"2026-10-15 22:17:51","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-15T21:37:58.217277Z","id":"CVE-2023-54042","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2023","CveId":"54042","Ordinal":"1","Title":"powerpc/64s: Fix VAS mm use after free","CVE":"CVE-2023-54042","Year":"2023"},"notes":[{"CveYear":"2023","CveId":"54042","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/64s: Fix VAS mm use after free\n\nThe refcount on mm is dropped before the coprocessor is detached.","Type":"Description","Title":"powerpc/64s: Fix VAS mm use after free"}]}}}