| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2021-46927: nitro_enclaves: Use get_user_pages_unlocked() call to handle mmap assert |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| nitro_enclaves: Use get_user_pages_unlocked() call to handle mmap assert |
| |
| After commit 5b78ed24e8ec ("mm/pagemap: add mmap_assert_locked() |
| annotations to find_vma*()"), the call to get_user_pages() will trigger |
| the mmap assert. |
| |
| static inline void mmap_assert_locked(struct mm_struct *mm) |
| { |
| lockdep_assert_held(&mm->mmap_lock); |
| VM_BUG_ON_MM(!rwsem_is_locked(&mm->mmap_lock), mm); |
| } |
| |
| [ 62.521410] kernel BUG at include/linux/mmap_lock.h:156! |
| ........................................................... |
| [ 62.538938] RIP: 0010:find_vma+0x32/0x80 |
| ........................................................... |
| [ 62.605889] Call Trace: |
| [ 62.608502] <TASK> |
| [ 62.610956] ? lock_timer_base+0x61/0x80 |
| [ 62.614106] find_extend_vma+0x19/0x80 |
| [ 62.617195] __get_user_pages+0x9b/0x6a0 |
| [ 62.620356] __gup_longterm_locked+0x42d/0x450 |
| [ 62.623721] ? finish_wait+0x41/0x80 |
| [ 62.626748] ? __kmalloc+0x178/0x2f0 |
| [ 62.629768] ne_set_user_memory_region_ioctl.isra.0+0x225/0x6a0 [nitro_enclaves] |
| [ 62.635776] ne_enclave_ioctl+0x1cf/0x6d7 [nitro_enclaves] |
| [ 62.639541] __x64_sys_ioctl+0x82/0xb0 |
| [ 62.642620] do_syscall_64+0x3b/0x90 |
| [ 62.645642] entry_SYSCALL_64_after_hwframe+0x44/0xae |
| |
| Use get_user_pages_unlocked() when setting the enclave memory regions. |
| That's a similar pattern as mmap_read_lock() used together with |
| get_user_pages(). |
| |
| The Linux kernel CVE team has assigned CVE-2021-46927 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.15 with commit 5b78ed24e8ec48602c1d6f5a188e58d000c81e2b and fixed in 5.15.13 with commit 90d2beed5e753805c5eab656b8d48257638fe543 |
| Issue introduced in 5.15 with commit 5b78ed24e8ec48602c1d6f5a188e58d000c81e2b and fixed in 5.16 with commit 3a0152b219523227c2a62a0a122cf99608287176 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2021-46927 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/virt/nitro_enclaves/ne_misc_dev.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/90d2beed5e753805c5eab656b8d48257638fe543 |
| https://git.kernel.org/stable/c/3a0152b219523227c2a62a0a122cf99608287176 |
