CVE-2023-54092

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pv: fix index value of replaced ASCE The index field of the struct page corresponding to a guest ASCE should be 0. When replacing the ASCE in s390_replace_asce(), the index of the new ASCE should also be set to 0. Having the wrong index might lead to the wrong addresses being passed around when notifying pte invalidations, and eventually to validity intercepts (VM crash) if the prefix gets unmapped and the notifier gets called with the wrong address.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://git.kernel.org/stable/c/017f686bcb536ff23d49c143fdf9d1fd89a9a924
https://git.kernel.org/stable/c/49a2686adddebe1ae76b4d368383208656ef6606
https://git.kernel.org/stable/c/8e635da0e0d3cb45e32fa79b36218fb98281bc10
https://git.kernel.org/stable/c/c2fceb59bbda16468bda82b002383bff59de89ab
https://git.kernel.org/stable/c/f1c7a776338f2ac5e34da40e58fe9f33ea390a5e

Configurations

No configuration.

History

No history.

Information

Published : 2025-12-24 13:16

Updated : 2026-08-04 10:19

NVD link : CVE-2023-54092

Mitre link : CVE-2023-54092

CVE.ORG link : CVE-2023-54092

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2023-54092", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9d216035d173214cd33712d67d89220ef2283ebf", "lessThan": "8e635da0e0d3cb45e32fa79b36218fb98281bc10", "versionType": "git"}, {"status": "affected", "version": "81ea65c9aefe100a9ace3082649bd84ae7dd9764", "lessThan": "49a2686adddebe1ae76b4d368383208656ef6606", "versionType": "git"}, {"status": "affected", "version": "faa2f72cb3569256480c5540d242c84e99965160", "lessThan": "017f686bcb536ff23d49c143fdf9d1fd89a9a924", "versionType": "git"}, {"status": "affected", "version": "faa2f72cb3569256480c5540d242c84e99965160", "lessThan": "f1c7a776338f2ac5e34da40e58fe9f33ea390a5e", "versionType": "git"}, {"status": "affected", "version": "faa2f72cb3569256480c5540d242c84e99965160", "lessThan": "c2fceb59bbda16468bda82b002383bff59de89ab", "versionType": "git"}, {"status": "affected", "version": "b5477f53e1d4de6191f50748a027251b14952eeb", "versionType": "git"}, {"status": "affected", "version": "63c71e83d5b6ab8adb5fcebef977052048016957", "versionType": "git"}, {"status": "affected", "version": "5.10.137", "lessThan": "5.10.190", "versionType": "semver"}, {"status": "affected", "version": "5.15.61", "lessThan": "5.15.124", "versionType": "semver"}, {"status": "affected", "version": "5.18.18", "lessThan": "5.19", "versionType": "semver"}, {"status": "affected", "version": "5.19.2", "lessThan": "5.20", "versionType": "semver"}], "programFiles": ["arch/s390/mm/gmap.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"status": "unaffected", "version": "0", "lessThan": "6.0", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.190", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.124", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.43", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.4.8", "versionType": "semver", "lessThanOrEqual": "6.4.*"}, {"status": "unaffected", "version": "6.5", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/s390/mm/gmap.c"], "defaultStatus": "affected"}]}], "published": "2025-12-24T13:16:11.073", "references": [{"url": "https://git.kernel.org/stable/c/017f686bcb536ff23d49c143fdf9d1fd89a9a924", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/49a2686adddebe1ae76b4d368383208656ef6606", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8e635da0e0d3cb45e32fa79b36218fb98281bc10", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c2fceb59bbda16468bda82b002383bff59de89ab", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f1c7a776338f2ac5e34da40e58fe9f33ea390a5e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pv: fix index value of replaced ASCE\n\nThe index field of the struct page corresponding to a guest ASCE should\nbe 0. When replacing the ASCE in s390_replace_asce(), the index of the\nnew ASCE should also be set to 0.\n\nHaving the wrong index might lead to the wrong addresses being passed\naround when notifying pte invalidations, and eventually to validity\nintercepts (VM crash) if the prefix gets unmapped and the notifier gets\ncalled with the wrong address."}], "lastModified": "2026-08-04T10:19:28.610", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}