CVE-2023-52750: arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
In the Linux kernel, the following vulnerability has been resolved:
arm64: Restrict CPUBIGENDIAN to GNU as or LLVM IAS 15.x or newer
Prior to LLVM 15.0.0, LLVM's integrated assembler would incorrectly byte-swap NOP when compiling for big-endian, and the resulting series of bytes happened to match the encoding of FNMADD S21, S30, S0, S0.
This went unnoticed until commit:
34f66c4c4d5518c1 ("arm64: Use a positive cpucap for FP/SIMD")
Prior to that commit, the kernel would always enable the use of FPSIMD early in boot when cpusetup() initialized CPACREL1, and so usage of FNMADD within the kernel was not detected, but could result in the corruption of user or kernel FPSIMD state.
After that commit, the instructions happen to trap during boot prior to FPSIMD being detected and enabled, e.g.
| Unhandled 64-bit el1h sync exception on CPU0, ESR 0x000000001fe00000 -- ASIMD | CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.0-rc3-00013-g34f66c4c4d55 #1 | Hardware name: linux,dummy-virt (DT) | pstate: 400000c9 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : pistrcmp+0x1c/0x150 | lr : populateproperties+0xe4/0x254 | sp : ffffd014173d3ad0 | x29: ffffd014173d3af0 x28: fffffbfffddffcb8 x27: 0000000000000000 | x26: 0000000000000058 x25: fffffbfffddfe054 x24: 0000000000000008 | x23: fffffbfffddfe000 x22: fffffbfffddfe000 x21: fffffbfffddfe044 | x20: ffffd014173d3b70 x19: 0000000000000001 x18: 0000000000000005 | x17: 0000000000000010 x16: 0000000000000000 x15: 00000000413e7000 | x14: 0000000000000000 x13: 0000000000001bcc x12: 0000000000000000 | x11: 00000000d00dfeed x10: ffffd414193f2cd0 x9 : 0000000000000000 | x8 : 0101010101010101 x7 : ffffffffffffffc0 x6 : 0000000000000000 | x5 : 0000000000000000 x4 : 0101010101010101 x3 : 000000000000002a | x2 : 0000000000000001 x1 : ffffd014171f2988 x0 : fffffbfffddffcb8 | Kernel panic - not syncing: Unhandled exception | CPU: 0 PID: 0 Comm: swapper Not tainted 6.6.0-rc3-00013-g34f66c4c4d55 #1 | Hardware name: linux,dummy-virt (DT) | Call trace: | dumpbacktrace+0xec/0x108 | showstack+0x18/0x2c | dumpstacklvl+0x50/0x68 | dumpstack+0x18/0x24 | panic+0x13c/0x340 | el1t64irqhandler+0x0/0x1c | el1abort+0x0/0x5c | el1h64sync+0x64/0x68 | pistrcmp+0x1c/0x150 | unflattendtnodes+0x1e8/0x2d8 | unflattendevicetree+0x5c/0x15c | unflattendevicetree+0x38/0x50 | setuparch+0x164/0x1e0 | startkernel+0x64/0x38c | primaryswitched+0xbc/0xc4
Restrict CONFIGCPUBIGENDIAN to a known good assembler, which is either GNU as or LLVM's IAS 15.0.0 and newer, which contains the linked commit.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52750?
CVE-2023-52750 has been rated as a moderate severity vulnerability due to potential implications on big-endian systems.
How do I fix CVE-2023-52750?
To mitigate CVE-2023-52750, update your Linux kernel to version 6.6.0-rc3-00013-g34f66c4c4d55 or newer.
Which versions of LLVM are affected by CVE-2023-52750?
CVE-2023-52750 affects versions of LLVM prior to 15.0.0, which have issues with the integrated assembler.
What systems are impacted by CVE-2023-52750?
CVE-2023-52750 primarily impacts systems using big-endian configurations in the Linux kernel.
Is CVE-2023-52750 a critical vulnerability?
No, CVE-2023-52750 is classified as moderate, but it still requires attention to prevent potential exploitation.