CVE-2024-35801: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD
In the Linux kernel, the following vulnerability has been resolved:
x86/fpu: Keep xfdstate in sync with MSRIA32XFD
Commit 672365477ae8 ("x86/fpu: Update XFD state where required") and commit 8bf26758ca96 ("x86/fpu: Add XFD state to fpstate") introduced a per CPU variable xfdstate to keep the MSRIA32XFD value cached, in order to avoid unnecessary writes to the MSR.
On CPU hotplug MSRIA32XFD is reset to the initfpstate.xfd, which wipes out any stale state. But the per CPU cached xfd value is not reset, which brings them out of sync.
As a consequence a subsequent xfdupdatestate() might fail to update the MSR which in turn can result in XRSTOR raising a #NM in kernel space, which crashes the kernel.
To fix this, introduce xfdsetstate() to write xfdstate together with MSRIA32XFD, and use it in all places that set MSRIA32XFD.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
x86/fpu: Keep xfdstate in sync with MSRIA32XFD
The Linux kernel CVE team has assigned CVE-2024-35801 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051738-CVE-2024-35801-8038@gregkh/T
— Red Hat
Linux Kernel is vulnerable to a denial of service, caused by a flaw when CPU hotplug MSRIA32XFD is reset to the initfpstate.xfd. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35801?
CVE-2024-35801 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-35801?
To fix CVE-2024-35801, update to kernel version 6.1.84 on Red Hat systems or appropriate versions as specified.
What products are affected by CVE-2024-35801?
CVE-2024-35801 affects various versions of the Linux kernel, specifically those listed in the vulnerability details.
Is my system vulnerable to CVE-2024-35801?
You may be vulnerable to CVE-2024-35801 if you are running an affected version of the Linux kernel prior to the recommended updates.
What type of vulnerability is CVE-2024-35801?
CVE-2024-35801 is an issue related to synchronization of the xfd_state in the x86 floating-point unit of the Linux kernel.