CVE-2023-52761: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52761 is a vulnerability in the Linux kernel's RISC-V implementation of VMAP_STACK overflow detection. The issue was discovered in the commit 31da94c25aea which added support for CONFIG_VMAP_STACK. The vulnerability affects the kernel's stack overflow handling mechanism where if two CPUs/harts are racing and end up in overflowing kernel stack, one or both can corrupt each other's state due to the shared shadow_stack not being CPU-specific (Kernel Git).

The vulnerability stems from the implementation of stack overflow detection in the RISC-V architecture. When a stack overflow is detected, the CPU switches to a shadow_stack temporarily before switching to per-cpu overflow_stack. The critical issue arises because the shadow_stack is shared between CPUs, leading to potential state corruption during concurrent overflow scenarios. The vulnerability specifically affects the kernel's ability to safely handle stack overflows in multi-CPU environments (Kernel Git).

When exploited, this vulnerability can lead to kernel state corruption when multiple CPUs simultaneously experience stack overflows. This can potentially result in system instability or crashes, particularly in scenarios where concurrent stack overflows occur. The impact is demonstrated through kernel panic messages showing 'Kernel stack overflow' errors (Kernel Git).

The vulnerability can be triggered in systems running the affected Linux kernel versions with RISC-V architecture when multiple CPUs experience simultaneous stack overflows. A test case has been documented using the command echo EXHAUST_STACK > /sys/kernel/debug/provoke-crash/DIRECT which can reproduce the issue (Kernel Git).

The issue has been resolved by optimizing the per-cpu overflow stack switch mechanism. The fix involves directly picking per-cpu overflow_stack and eliminating the shared shadow_stack. The patch implements an assembly macro to obtain per-cpu symbols in the destination register and modifies the entry.S file to handle overflow detection using per-cpu overflow stack (Kernel Git).