CVE-2023-52597: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52597 affects the Linux kernel's KVM (Kernel-based Virtual Machine) implementation on s390 architecture. The vulnerability was discovered in the floating point control (fpc) register handling within the kvm_arch_vcpu_ioctl_set_fpu() function. The issue was disclosed in November 2023 and affects various Linux kernel versions (Kernel Git).

The vulnerability occurs in the KVM s390 architecture implementation where the test_fp_ctl() function restores the original user space/host process fpc register value, but this value gets discarded when returning to user space. When setting the fpc register via kvm_arch_vcpu_ioctl_set_fpu(), the new value is tested for validity by temporarily loading it into the fpc register. If an interrupt occurs during this process and floating point or vector registers are used within the interrupt context, the current fp/vx registers are saved with save_fpu_regs() assuming they belong to user space (Kernel Git).

The vulnerability can lead to corruption of the fpc register of the host process. As a result, the host process will incorrectly continue to run with the value that was intended for a guest CPU, potentially affecting system stability and security (Kernel Git).

The vulnerability requires access to KVM functionality on s390 systems and the ability to trigger the specific condition during fpc register handling. No known exploits in the wild have been reported (NVD).

The issue has been fixed by removing the test_fp_ctl() validation step, as there is another test performed before the SIE context is entered that handles invalid values. The fix changes the behavior so that invalid values are now accepted instead of failing with -EINVAL. This change is considered acceptable since the interface is rarely used, and it aligns with the behavior of the memory-mapped interface (Kernel Git).