{"timestamp":"2024-04-02T12:41:02.015400Z","id":"CVE-2024-26674","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/lib/getuser.S","arch/x86/lib/putuser.S"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b19b74bc99b1501a550f4448d04d59b946dc617a","lessThan":"2aed1b6c33afd8599d01c6532bbecb829480a674","versionType":"git","status":"affected"},{"version":"b19b74bc99b1501a550f4448d04d59b946dc617a","lessThan":"2da241c5ed78d0978228a1150735539fe1a60eca","versionType":"git","status":"affected"},{"version":"b19b74bc99b1501a550f4448d04d59b946dc617a","lessThan":"8eed4e00a370b37b4e5985ed983dccedd555ea9d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/lib/getuser.S","arch/x86/lib/putuser.S"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.17","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.7.5","lessThanOrEqual":"6.7.*","versionType":"semver","status":"unaffected"},{"version":"6.8","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-787

OR
          *cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 from (excluding) 6.7.5
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.4 from (excluding) 6.6.17

CVE: https://git.kernel.org/stable/c/2aed1b6c33afd8599d01c6532bbecb829480a674 Types: Patch

CVE: https://git.kernel.org/stable/c/2da241c5ed78d0978228a1150735539fe1a60eca Types: Patch

CVE: https://git.kernel.org/stable/c/8eed4e00a370b37b4e5985ed983dccedd555ea9d Types: Patch

kernel.org: https://git.kernel.org/stable/c/2aed1b6c33afd8599d01c6532bbecb829480a674 Types: Patch

kernel.org: https://git.kernel.org/stable/c/2da241c5ed78d0978228a1150735539fe1a60eca Types: Patch

kernel.org: https://git.kernel.org/stable/c/8eed4e00a370b37b4e5985ed983dccedd555ea9d Types: Patch

https://git.kernel.org/stable/c/2aed1b6c33afd8599d01c6532bbecb829480a674

https://git.kernel.org/stable/c/2da241c5ed78d0978228a1150735539fe1a60eca

https://git.kernel.org/stable/c/8eed4e00a370b37b4e5985ed983dccedd555ea9d

In the Linux kernel, the following vulnerability has been resolved:

x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups

During memory error injection test on kernels >= v6.4, the kernel panics
like below. However, this issue couldn't be reproduced on kernels <= v6.3.

  mce: [Hardware Error]: CPU 296: Machine Check Exception: f Bank 1: bd80000000100134
  mce: [Hardware Error]: RIP 10:<ffffffff821b9776> {__get_user_nocheck_4+0x6/0x20}
  mce: [Hardware Error]: TSC 411a93533ed ADDR 346a8730040 MISC 86
  mce: [Hardware Error]: PROCESSOR 0:a06d0 TIME 1706000767 SOCKET 1 APIC 211 microcode 80001490
  mce: [Hardware Error]: Run the above through 'mcelog --ascii'
  mce: [Hardware Error]: Machine check: Data load in unrecoverable area of kernel
  Kernel panic - not syncing: Fatal local machine check

The MCA code can recover from an in-kernel #MC if the fixup type is
EX_TYPE_UACCESS, explicitly indicating that the kernel is attempting to
access userspace memory. However, if the fixup type is EX_TYPE_DEFAULT
the only thing that is raised for an in-kernel #MC is a panic.

ex_handler_uaccess() would warn if users gave a non-canonical addresses
(with bit 63 clear) to {get, put}_user(), which was unexpected.

Therefore, commit

  b19b74bc99b1 ("x86/mm: Rework address range check in get_user() and put_user()")

replaced _ASM_EXTABLE_UA() with _ASM_EXTABLE() for {get, put}_user()
fixups. However, the new fixup type EX_TYPE_DEFAULT results in a panic.

Commit

  6014bc27561f ("x86-64: make access_ok() independent of LAM")

added the check gp_fault_address_ok() right before the WARN_ONCE() in
ex_handler_uaccess() to not warn about non-canonical user addresses due
to LAM.

With that in place, revert back to _ASM_EXTABLE_UA() for {get,put}_user()
exception fixups in order to be able to handle in-kernel MCEs correctly
again.

  [ bp: Massage commit message. ]

kernel.org https://git.kernel.org/stable/c/2aed1b6c33afd8599d01c6532bbecb829480a674 [No types assigned]

kernel.org https://git.kernel.org/stable/c/2da241c5ed78d0978228a1150735539fe1a60eca [No types assigned]

kernel.org https://git.kernel.org/stable/c/8eed4e00a370b37b4e5985ed983dccedd555ea9d [No types assigned]