| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-42096: x86: stop playing stack games in profile_pc() |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| x86: stop playing stack games in profile_pc() |
| |
| The 'profile_pc()' function is used for timer-based profiling, which |
| isn't really all that relevant any more to begin with, but it also ends |
| up making assumptions based on the stack layout that aren't necessarily |
| valid. |
| |
| Basically, the code tries to account the time spent in spinlocks to the |
| caller rather than the spinlock, and while I support that as a concept, |
| it's not worth the code complexity or the KASAN warnings when no serious |
| profiling is done using timers anyway these days. |
| |
| And the code really does depend on stack layout that is only true in the |
| simplest of cases. We've lost the comment at some point (I think when |
| the 32-bit and 64-bit code was unified), but it used to say: |
| |
| Assume the lock function has either no stack frame or a copy |
| of eflags from PUSHF. |
| |
| which explains why it just blindly loads a word or two straight off the |
| stack pointer and then takes a minimal look at the values to just check |
| if they might be eflags or the return pc: |
| |
| Eflags always has bits 22 and up cleared unlike kernel addresses |
| |
| but that basic stack layout assumption assumes that there isn't any lock |
| debugging etc going on that would complicate the code and cause a stack |
| frame. |
| |
| It causes KASAN unhappiness reported for years by syzkaller [1] and |
| others [2]. |
| |
| With no real practical reason for this any more, just remove the code. |
| |
| Just for historical interest, here's some background commits relating to |
| this code from 2006: |
| |
| 0cb91a229364 ("i386: Account spinlocks to the caller during profiling for !FP kernels") |
| 31679f38d886 ("Simplify profile_pc on x86-64") |
| |
| and a code unification from 2009: |
| |
| ef4512882dbe ("x86: time_32/64.c unify profile_pc") |
| |
| but the basics of this thing actually goes back to before the git tree. |
| |
| The Linux kernel CVE team has assigned CVE-2024-42096 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Fixed in 4.19.317 with commit 65ebdde16e7f5da99dbf8a548fb635837d78384e |
| Fixed in 5.4.279 with commit 27c3be840911b15a3f24ed623f86153c825b6b29 |
| Fixed in 5.10.221 with commit 49c09ca35a5f521d7fa18caf62fdf378f15e8aa4 |
| Fixed in 5.15.162 with commit 2d07fea561d64357fb7b3f3751e653bf20306d77 |
| Fixed in 6.1.97 with commit 161cef818545ecf980f0e2ebaf8ba7326ce53c2b |
| Fixed in 6.6.37 with commit 16222beb9f8e5ceb0beeb5cbe54bef16df501a92 |
| Fixed in 6.9.8 with commit a3b65c8cbc139bfce9541bc81c1bb766e5ba3f68 |
| Fixed in 6.10 with commit 093d9603b60093a9aaae942db56107f6432a5dca |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-42096 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| arch/x86/kernel/time.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/65ebdde16e7f5da99dbf8a548fb635837d78384e |
| https://git.kernel.org/stable/c/27c3be840911b15a3f24ed623f86153c825b6b29 |
| https://git.kernel.org/stable/c/49c09ca35a5f521d7fa18caf62fdf378f15e8aa4 |
| https://git.kernel.org/stable/c/2d07fea561d64357fb7b3f3751e653bf20306d77 |
| https://git.kernel.org/stable/c/161cef818545ecf980f0e2ebaf8ba7326ce53c2b |
| https://git.kernel.org/stable/c/16222beb9f8e5ceb0beeb5cbe54bef16df501a92 |
| https://git.kernel.org/stable/c/a3b65c8cbc139bfce9541bc81c1bb766e5ba3f68 |
| https://git.kernel.org/stable/c/093d9603b60093a9aaae942db56107f6432a5dca |
