CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors
In the Linux kernel, the following vulnerability has been resolved:
x86/MCE: Always save CS register on AMD Zen IF Poison errors
The Instruction Fetch (IF) units on current AMD Zen-based systems do not
guarantee a synchronous #MC is delivered for poison consumption errors.
Therefore, MCG_STATUS[EIPV|RIPV] will not be set. However, the
microarchitecture does guarantee that the exception is delivered within
the same context. In other words, the exact rIP is not known, but the
context is known to not have changed.
There is no architecturally-defined method to determine this behavior.
The Code Segment (CS) register is always valid on such IF unit poison
errors regardless of the value of MCG_STATUS[EIPV|RIPV].
Add a quirk to save the CS register for poison consumption from the IF
unit banks.
This is needed to properly determine the context of the error.
Otherwise, the severity grading function will assume the context is
IN_KERNEL due to the m->cs value being 0 (the initialized value). This
leads to unnecessary kernel panics on data poison errors due to the
kernel believing the poison consumption occurred in kernel context.
Security readout for executives and security teams
Plain-English summary
This Linux kernel issue affects error handling on AMD Zen-based systems. Certain CPU memory-poison events may be misclassified as kernel-context errors because the kernel does not save the code segment register. The business impact is unnecessary kernel panics, meaning availability loss rather than data theft or privilege escalation.
Executive priority
Handle in the normal kernel patch cycle, with faster action for critical AMD Zen production workloads. There is no cited active exploitation, but the availability impact can be material if kernel panics affect core services.
Technical view
On AMD Zen IF poison consumption errors, MCG_STATUS EIPV/RIPV may be unset although the execution context remains valid. Without saving CS, m->cs stays zero, causing severity grading to assume IN_KERNEL and panic unnecessarily. The fix adds a quirk to always save CS for IF unit poison banks.
Likely exposure
Exposure is most relevant to Linux systems running affected kernels on AMD Zen-based hardware. The source does not identify affected distributions or cloud instance families. Validate through kernel package advisories and whether the referenced stable commits are included.
Exploitation context
The CVSS vector is local, low complexity, and requires low privileges, with high availability impact only. The source bundle says KEV is false and provides no evidence of active exploitation. Treat this as an availability and reliability risk, not a confirmed exploited vulnerability.
Researcher notes
The key behavior is architectural ambiguity around synchronous machine checks for AMD Zen IF poison errors. The fix relies on a model-specific quirk: CS remains valid even when EIPV/RIPV are unset. Exact distro exposure requires downstream advisory confirmation.
Mitigation direction
Apply vendor kernel updates that include the referenced stable Linux fixes.
Prioritize AMD Zen-based production systems where unexpected reboots have high business impact.
Use distribution advisories to confirm the fixed kernel package for your environment.
Schedule reboots or live-patching according to existing kernel maintenance policy.
Validation and detection
Inventory Linux hosts running on AMD Zen-based processors.
Compare running kernel packages with vendor guidance for CVE-2023-53438.
Confirm whether deployed kernels include one of the referenced stable commits.
Review machine-check and panic history for unexplained availability events.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2023-53438 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.