{"timestamp":"2024-03-05T22:19:02.450958Z","id":"CVE-2021-46997","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/arm64/include/asm/daifflags.h","arch/arm64/kernel/entry-common.c","arch/arm64/kernel/entry.S"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"23529049c68423820487304f244144e0d576e85a","lessThan":"51524fa8b5f7b879ba569227738375d283b79382","versionType":"git","status":"affected"},{"version":"23529049c68423820487304f244144e0d576e85a","lessThan":"e67a83f078005461b59b4c776e6b5addd11725fa","versionType":"git","status":"affected"},{"version":"23529049c68423820487304f244144e0d576e85a","lessThan":"d8d52005f57bbb4a4ec02f647e2555d327135c68","versionType":"git","status":"affected"},{"version":"23529049c68423820487304f244144e0d576e85a","lessThan":"4d6a38da8e79e94cbd1344aa90876f0f805db705","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/arm64/include/asm/daifflags.h","arch/arm64/kernel/entry-common.c","arch/arm64/kernel/entry.S"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","versionType":"semver","status":"unaffected"},{"version":"5.10.38","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.11.22","lessThanOrEqual":"5.11.*","versionType":"semver","status":"unaffected"},{"version":"5.12.5","lessThanOrEqual":"5.12.*","versionType":"semver","status":"unaffected"},{"version":"5.13","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NIST NVD-CWE-noinfo

OR
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.10 up to (excluding) 5.10.38
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.11.22
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.12 up to (excluding) 5.12.5

https://git.kernel.org/stable/c/4d6a38da8e79e94cbd1344aa90876f0f805db705 No Types Assigned

https://git.kernel.org/stable/c/4d6a38da8e79e94cbd1344aa90876f0f805db705 Patch

https://git.kernel.org/stable/c/4d6a38da8e79e94cbd1344aa90876f0f805db705 No Types Assigned

https://git.kernel.org/stable/c/4d6a38da8e79e94cbd1344aa90876f0f805db705 Patch

https://git.kernel.org/stable/c/51524fa8b5f7b879ba569227738375d283b79382 No Types Assigned

https://git.kernel.org/stable/c/51524fa8b5f7b879ba569227738375d283b79382 Patch

https://git.kernel.org/stable/c/51524fa8b5f7b879ba569227738375d283b79382 No Types Assigned

https://git.kernel.org/stable/c/51524fa8b5f7b879ba569227738375d283b79382 Patch

https://git.kernel.org/stable/c/d8d52005f57bbb4a4ec02f647e2555d327135c68 No Types Assigned

https://git.kernel.org/stable/c/d8d52005f57bbb4a4ec02f647e2555d327135c68 Patch

https://git.kernel.org/stable/c/d8d52005f57bbb4a4ec02f647e2555d327135c68 No Types Assigned

https://git.kernel.org/stable/c/d8d52005f57bbb4a4ec02f647e2555d327135c68 Patch

https://git.kernel.org/stable/c/e67a83f078005461b59b4c776e6b5addd11725fa No Types Assigned

https://git.kernel.org/stable/c/e67a83f078005461b59b4c776e6b5addd11725fa Patch

https://git.kernel.org/stable/c/e67a83f078005461b59b4c776e6b5addd11725fa No Types Assigned

https://git.kernel.org/stable/c/e67a83f078005461b59b4c776e6b5addd11725fa Patch

https://git.kernel.org/stable/c/4d6a38da8e79e94cbd1344aa90876f0f805db705

https://git.kernel.org/stable/c/51524fa8b5f7b879ba569227738375d283b79382

https://git.kernel.org/stable/c/d8d52005f57bbb4a4ec02f647e2555d327135c68

https://git.kernel.org/stable/c/e67a83f078005461b59b4c776e6b5addd11725fa

In the Linux kernel, the following vulnerability has been resolved:

arm64: entry: always set GIC_PRIO_PSR_I_SET during entry

Zenghui reports that booting a kernel with "irqchip.gicv3_pseudo_nmi=1"
on the command line hits a warning during kernel entry, due to the way
we manipulate the PMR.

Early in the entry sequence, we call lockdep_hardirqs_off() to inform
lockdep that interrupts have been masked (as the HW sets DAIF wqhen
entering an exception). Architecturally PMR_EL1 is not affected by
exception entry, and we don't set GIC_PRIO_PSR_I_SET in the PMR early in
the exception entry sequence, so early in exception entry the PMR can
indicate that interrupts are unmasked even though they are masked by
DAIF.

If DEBUG_LOCKDEP is selected, lockdep_hardirqs_off() will check that
interrupts are masked, before we set GIC_PRIO_PSR_I_SET in any of the
exception entry paths, and hence lockdep_hardirqs_off() will WARN() that
something is amiss.

We can avoid this by consistently setting GIC_PRIO_PSR_I_SET during
exception entry so that kernel code sees a consistent environment. We
must also update local_daif_inherit() to undo this, as currently only
touches DAIF. For other paths, local_daif_restore() will update both
DAIF and the PMR. With this done, we can remove the existing special
cases which set this later in the entry code.

We always use (GIC_PRIO_IRQON | GIC_PRIO_PSR_I_SET) for consistency with
local_daif_save(), as this will warn if it ever encounters
(GIC_PRIO_IRQOFF | GIC_PRIO_PSR_I_SET), and never sets this itself. This
matches the gic_prio_kentry_setup that we have to retain for
ret_to_user.

The original splat from Zenghui's report was:

| DEBUG_LOCKS_WARN_ON(!irqs_disabled())
| WARNING: CPU: 3 PID: 125 at kernel/locking/lockdep.c:4258 lockdep_hardirqs_off+0xd4/0xe8
| Modules linked in:
| CPU: 3 PID: 125 Comm: modprobe Tainted: G        W         5.12.0-rc8+ #463
| Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
| pstate: 604003c5 (nZCv DAIF +PAN -UAO -TCO BTYPE=--)
| pc : lockdep_hardirqs_off

Linux https://git.kernel.org/stable/c/4d6a38da8e79e94cbd1344aa90876f0f805db705 [No types assigned]

Linux https://git.kernel.org/stable/c/51524fa8b5f7b879ba569227738375d283b79382 [No types assigned]

Linux https://git.kernel.org/stable/c/d8d52005f57bbb4a4ec02f647e2555d327135c68 [No types assigned]

Linux https://git.kernel.org/stable/c/e67a83f078005461b59b4c776e6b5addd11725fa [No types assigned]