CVE-2024-26674: x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups
First published: Tue Apr 02 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups During memory error injection test on kernels >= v6.4, the kernel panics like below. However, this issue couldn't be reproduced on kernels <= v6.3. mce: [Hardware Error]: CPU 296: Machine Check Exception: f Bank 1: bd80000000100134 mce: [Hardware Error]: RIP 10:<ffffffff821b9776> {__get_user_nocheck_4+0x6/0x20} mce: [Hardware Error]: TSC 411a93533ed ADDR 346a8730040 MISC 86 mce: [Hardware Error]: PROCESSOR 0:a06d0 TIME 1706000767 SOCKET 1 APIC 211 microcode 80001490 mce: [Hardware Error]: Run the above through 'mcelog --ascii' mce: [Hardware Error]: Machine check: Data load in unrecoverable area of kernel Kernel panic - not syncing: Fatal local machine check The MCA code can recover from an in-kernel #MC if the fixup type is EX_TYPE_UACCESS, explicitly indicating that the kernel is attempting to access userspace memory. However, if the fixup type is EX_TYPE_DEFAULT the only thing that is raised for an in-kernel #MC is a panic. ex_handler_uaccess() would warn if users gave a non-canonical addresses (with bit 63 clear) to {get, put}_user(), which was unexpected. Therefore, commit b19b74bc99b1 ("x86/mm: Rework address range check in get_user() and put_user()") replaced _ASM_EXTABLE_UA() with _ASM_EXTABLE() for {get, put}_user() fixups. However, the new fixup type EX_TYPE_DEFAULT results in a panic. Commit 6014bc27561f ("x86-64: make access_ok() independent of LAM") added the check gp_fault_address_ok() right before the WARN_ONCE() in ex_handler_uaccess() to not warn about non-canonical user addresses due to LAM. With that in place, revert back to _ASM_EXTABLE_UA() for {get,put}_user() exception fixups in order to be able to handle in-kernel MCEs correctly again. [ bp: Massage commit message. ]
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel | <6.6.17 | 6.6.17 |
| redhat/kernel | <6.7.5 | 6.7.5 |
| redhat/kernel | <6.8 | 6.8 |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.115-1 6.1.112-1 6.11.7-1 6.11.9-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/2aed1b6c33afd8599d01c6532bbecb829480a674
- https://git.kernel.org/stable/c/2da241c5ed78d0978228a1150735539fe1a60eca
- https://git.kernel.org/stable/c/8eed4e00a370b37b4e5985ed983dccedd555ea9d
- https://launchpad.net/bugs/cve/CVE-2024-26674
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26674
- https://nvd.nist.gov/vuln/detail/CVE-2024-26674
- https://security-tracker.debian.org/tracker/CVE-2024-26674
- https://ubuntu.com/security/CVE-2024-26674
- https://git.kernel.org/linus/8eed4e00a370b37b4e5985ed983dccedd555ea9d
- https://access.redhat.com/security/cve/CVE-2024-26674
- https://lore.kernel.org/linux-cve-announce/2024040252-CVE-2024-26674-4ff9@gregkh/T
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2272819
- https://access.redhat.com/errata/RHSA-2024:9315
- https://bugzilla.redhat.com/show_bug.cgi?id=2272818
- agent/severity
- agent/title
- agent/type
- collector/nvd-api
- source/NVD
- agent/remedy
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/nvd-cve
- agent/author
- agent/references
- collector/usn-cve
- source/Ubuntu
- agent/description
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-26674
- package-manager/debian
- package-manager/redhat