CVE-2024-41065: powerpc/pseries: Whitelist dtl slub object for copying to userspace
In the Linux kernel, the following vulnerability has been resolved:
powerpc/pseries: Whitelist dtl slub object for copying to userspace
Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu- results in a BUG() when the config CONFIGHARDENEDUSERCOPY is enabled as shown below.
kernel BUG at mm/usercopy.c:102! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGESIZE=64K MMU=Radix SMP NRCPUS=2048 NUMA pSeries Modules linked in: xfs libcrc32c dmservicetime sdmod t10pi sg ibmvfc scsitransportfc ibmveth pserieswdt dmmultipath dmmirror dmregionhash dmlog dmmod fuse CPU: 27 PID: 1815 Comm: python3 Not tainted 6.10.0-rc3 #85 Hardware name: IBM,9040-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060042) hv:phyp pSeries NIP: c0000000005d23d4 LR: c0000000005d23d0 CTR: 00000000006ee6f8 REGS: c000000120c078c0 TRAP: 0700 Not tainted (6.10.0-rc3) MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 2828220f XER: 0000000e CFAR: c0000000001fdc80 IRQMASK: 0 [ ... GPRs omitted ... ] NIP [c0000000005d23d4] usercopyabort+0x78/0xb0 LR [c0000000005d23d0] usercopyabort+0x74/0xb0 Call Trace: usercopyabort+0x74/0xb0 (unreliable) checkheapobject+0xf8/0x120 checkheapobject+0x218/0x240 checkobjectsize+0x84/0x1a4 dtlfileread+0x17c/0x2c4 fullproxyread+0x8c/0x110 vfsread+0xdc/0x3a0 ksysread+0x84/0x144 systemcallexception+0x124/0x330 systemcallvectoredcommon+0x15c/0x2ec --- interrupt: 3000 at 0x7fff81f3ab34
Commit 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0") requires that only whitelisted areas in slab/slub objects can be copied to userspace when usercopy hardening is enabled using CONFIGHARDENEDUSERCOPY. Dtl contains hypervisor dispatch events which are expected to be read by privileged users. Hence mark this safe for user access. Specify useroffset=0 and usersize=DISPATCHLOGBYTES to whitelist the entire object.
Other sources
Linux Kernel is vulnerable to a denial of service, caused by a flaw in Powerpc/Pseries. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41065?
CVE-2024-41065 has a severity rating of medium, indicating a moderate impact on system security.
How do I fix CVE-2024-41065?
To fix CVE-2024-41065, update the Linux kernel to versions 5.4.281, 5.10.223, 5.15.164, 6.1.101, 6.6.42, 6.9.11, or 6.10, according to the source and package used.
What systems are affected by CVE-2024-41065?
CVE-2024-41065 affects various versions of the Linux kernel across different distributions including Red Hat and Debian.
Can CVE-2024-41065 lead to system crashes?
Yes, exploiting CVE-2024-41065 can lead to system instability and may cause crashes when triggering a BUG() in the dispatch trace log.
Is CVE-2024-41065 related to user copy functions?
Yes, CVE-2024-41065 is related to hardened user copy functions in the Linux kernel, specifically affecting the handling of slub objects.