| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2023-52750: arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer |
| |
| Prior to LLVM 15.0.0, LLVM's integrated assembler would incorrectly |
| byte-swap NOP when compiling for big-endian, and the resulting series of |
| bytes happened to match the encoding of FNMADD S21, S30, S0, S0. |
| |
| This went unnoticed until commit: |
| |
| 34f66c4c4d5518c1 ("arm64: Use a positive cpucap for FP/SIMD") |
| |
| Prior to that commit, the kernel would always enable the use of FPSIMD |
| early in boot when __cpu_setup() initialized CPACR_EL1, and so usage of |
| FNMADD within the kernel was not detected, but could result in the |
| corruption of user or kernel FPSIMD state. |
| |
| After that commit, the instructions happen to trap during boot prior to |
| FPSIMD being detected and enabled, e.g. |
| |
| | Unhandled 64-bit el1h sync exception on CPU0, ESR 0x000000001fe00000 -- ASIMD |
| | CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.0-rc3-00013-g34f66c4c4d55 #1 |
| | Hardware name: linux,dummy-virt (DT) |
| | pstate: 400000c9 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) |
| | pc : __pi_strcmp+0x1c/0x150 |
| | lr : populate_properties+0xe4/0x254 |
| | sp : ffffd014173d3ad0 |
| | x29: ffffd014173d3af0 x28: fffffbfffddffcb8 x27: 0000000000000000 |
| | x26: 0000000000000058 x25: fffffbfffddfe054 x24: 0000000000000008 |
| | x23: fffffbfffddfe000 x22: fffffbfffddfe000 x21: fffffbfffddfe044 |
| | x20: ffffd014173d3b70 x19: 0000000000000001 x18: 0000000000000005 |
| | x17: 0000000000000010 x16: 0000000000000000 x15: 00000000413e7000 |
| | x14: 0000000000000000 x13: 0000000000001bcc x12: 0000000000000000 |
| | x11: 00000000d00dfeed x10: ffffd414193f2cd0 x9 : 0000000000000000 |
| | x8 : 0101010101010101 x7 : ffffffffffffffc0 x6 : 0000000000000000 |
| | x5 : 0000000000000000 x4 : 0101010101010101 x3 : 000000000000002a |
| | x2 : 0000000000000001 x1 : ffffd014171f2988 x0 : fffffbfffddffcb8 |
| | Kernel panic - not syncing: Unhandled exception |
| | CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.0-rc3-00013-g34f66c4c4d55 #1 |
| | Hardware name: linux,dummy-virt (DT) |
| | Call trace: |
| | dump_backtrace+0xec/0x108 |
| | show_stack+0x18/0x2c |
| | dump_stack_lvl+0x50/0x68 |
| | dump_stack+0x18/0x24 |
| | panic+0x13c/0x340 |
| | el1t_64_irq_handler+0x0/0x1c |
| | el1_abort+0x0/0x5c |
| | el1h_64_sync+0x64/0x68 |
| | __pi_strcmp+0x1c/0x150 |
| | unflatten_dt_nodes+0x1e8/0x2d8 |
| | __unflatten_device_tree+0x5c/0x15c |
| | unflatten_device_tree+0x38/0x50 |
| | setup_arch+0x164/0x1e0 |
| | start_kernel+0x64/0x38c |
| | __primary_switched+0xbc/0xc4 |
| |
| Restrict CONFIG_CPU_BIG_ENDIAN to a known good assembler, which is |
| either GNU as or LLVM's IAS 15.0.0 and newer, which contains the linked |
| commit. |
| |
| The Linux kernel CVE team has assigned CVE-2023-52750 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Fixed in 5.10.202 with commit d08a1e75253b4e19ae290b1c35349f12cfcebc0a |
| Fixed in 5.15.140 with commit 936c9c10efaefaf1ab3ef020e1f8aaaaff1ad2f9 |
| Fixed in 6.1.64 with commit ef0224ee5399ea8a46bc07dc6c6494961ed5fdd2 |
| Fixed in 6.5.13 with commit bd31e534721ab95ef237020fe6995c899ffdf21a |
| Fixed in 6.6.3 with commit 69e619d2fd056fe1f5d0adf01584f2da669e0d28 |
| Fixed in 6.7 with commit 146a15b873353f8ac28dc281c139ff611a3c4848 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2023-52750 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| arch/arm64/Kconfig |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/d08a1e75253b4e19ae290b1c35349f12cfcebc0a |
| https://git.kernel.org/stable/c/936c9c10efaefaf1ab3ef020e1f8aaaaff1ad2f9 |
| https://git.kernel.org/stable/c/ef0224ee5399ea8a46bc07dc6c6494961ed5fdd2 |
| https://git.kernel.org/stable/c/bd31e534721ab95ef237020fe6995c899ffdf21a |
| https://git.kernel.org/stable/c/69e619d2fd056fe1f5d0adf01584f2da669e0d28 |
| https://git.kernel.org/stable/c/146a15b873353f8ac28dc281c139ff611a3c4848 |
