CVE-2022-50720: x86/apic: Don't disable x2APIC if locked
In the Linux kernel, the following vulnerability has been resolved:
x86/apic: Don't disable x2APIC if locked
The APIC supports two modes, legacy APIC (or xAPIC), and Extended APIC (or x2APIC). X2APIC mode is mostly compatible with legacy APIC, but it disables the memory-mapped APIC interface in favor of one that uses MSRs. The APIC mode is controlled by the EXT bit in the APIC MSR.
The MMIO/xAPIC interface has some problems, most notably the APIC LEAK [1]. This bug allows an attacker to use the APIC MMIO interface to extract data from the SGX enclave.
Introduce support for a new feature that will allow the BIOS to lock the APIC in x2APIC mode. If the APIC is locked in x2APIC mode and the kernel tries to disable the APIC or revert to legacy APIC mode a GP fault will occur.
Introduce support for a new MSR (IA32XAPICDISABLESTATUS) and handle the new locked mode when the LEGACYXAPICDISABLED bit is set by preventing the kernel from trying to disable the x2APIC.
On platforms with the IA32XAPICDISABLESTATUS MSR, if SGX or TDX are enabled the LEGACYXAPICDISABLED will be set by the BIOS. If legacy APIC is required, then it SGX and TDX need to be disabled in the BIOS.
[1]: https://aepicleak.com/aepicleak.pdf
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.0.3-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.19.17 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.0.3 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Configuration
Disable SGX and TDX in the BIOS if legacy APIC mode is required.
BIOS SGX and TDX = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50720?
CVE-2022-50720 is classified as a medium severity vulnerability within the Linux kernel.
How do I fix CVE-2022-50720?
To address CVE-2022-50720, users should update their Linux kernel to the latest stable version that includes the patch for this vulnerability.
What does CVE-2022-50720 impact?
CVE-2022-50720 impacts the x86 architecture's Advanced Programmable Interrupt Controller (APIC) in the Linux kernel.
Is CVE-2022-50720 a remote code execution vulnerability?
No, CVE-2022-50720 does not allow for remote code execution, but it may lead to privilege escalation scenarios.
Can CVE-2022-50720 be exploited by an attacker?
An attacker with local access might be able to exploit CVE-2022-50720 to manipulate the APIC settings and potentially impact system operations.