From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EE0B137149 for ; Thu, 29 Feb 2024 05:43:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709185408; cv=none; b=c9jjBdeUtOPzlk3KRz/fC2XYwUYhHylmEbxx3+9v0adT2HPfkp0OZoOOwMQ5KsnIk1PEqdsGST3Isb5n879LzMLV9XwesLl1blocp17X29kcTW7QC7SCenh/tzCUKJ9Dt7gozxOzr/OEoYKBcUWnqKKu7jdpi2l/L5bZ4TeJ8ik= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709185408; c=relaxed/simple; bh=Vsq4fnIYToHS6LJ2BFg+SXyOowBvR51X2/hf2Ikg2Xc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Mqk+X0gMD3Kqxg+QYuh4BBgTOey92c80wLmTEeXRVjbo41fvD/DBXs7F5cBpGAdjUwDsNYhrMjK2V9adOU9W0nonuikq0Ca6fuwORPFsw4lEWTKaNHqwAhsmu7U6yL+dZ0S6Vhape+RvZibjNZlktkDgAwpr+94xjuCRQqI6aig= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Eh9XW8MN; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Eh9XW8MN" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DC33AC433F1; Thu, 29 Feb 2024 05:43:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1709185407; bh=Vsq4fnIYToHS6LJ2BFg+SXyOowBvR51X2/hf2Ikg2Xc=; h=From:To:Cc:Subject:Date:Reply-to:From; b=Eh9XW8MNFvNNjuLz4booJrNZLZwIbbbtWUMlwL1BokLqaL1ZrRhW0kbKNbWiunO1i Hyefj+F0JfpK9xg8uMkQExaeu/XAdYqXfbi6wJHw0hhaLbf82A8OE4bxWG+9FY5Kbi ZNhWwlkVgCHo3aOEKFSz97v82pi3WsjC/Dxgr2yc= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: gregkh@kernel.org Subject: CVE-2023-52476: perf/x86/lbr: Filter vsyscall addresses Date: Thu, 29 Feb 2024 06:43:19 +0100 Message-ID: <2024022921-CVE-2023-52476-e307@gregkh> X-Mailer: git-send-email 2.44.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2884; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=c3EC+pUxUcrtX2hQBD1WY3nQi7ZPfMOPQ2NXL4dPysM=; b=owGbwMvMwCRo6H6F97bub03G02pJDKkPJCtjD2cUXVwfIfIja2Ozmt6z4/Pnl854aCm4rcZj4 87GVasCO2JZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAinxsY5gclaIosuB6+bc6S c/kvdl54FFCkn8Sw4DjPbVeOadHHs07GfMuf1zez7vHUMgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: gregkh@kernel.org Description =========== In the Linux kernel, the following vulnerability has been resolved: perf/x86/lbr: Filter vsyscall addresses We found that a panic can occur when a vsyscall is made while LBR sampling is active. If the vsyscall is interrupted (NMI) for perf sampling, this call sequence can occur (most recent at top): __insn_get_emulate_prefix() insn_get_emulate_prefix() insn_get_prefixes() insn_get_opcode() decode_branch_type() get_branch_type() intel_pmu_lbr_filter() intel_pmu_handle_irq() perf_event_nmi_handler() Within __insn_get_emulate_prefix() at frame 0, a macro is called: peek_nbyte_next(insn_byte_t, insn, i) Within this macro, this dereference occurs: (insn)->next_byte Inspecting registers at this point, the value of the next_byte field is the address of the vsyscall made, for example the location of the vsyscall version of gettimeofday() at 0xffffffffff600000. The access to an address in the vsyscall region will trigger an oops due to an unhandled page fault. To fix the bug, filtering for vsyscalls can be done when determining the branch type. This patch will return a "none" branch if a kernel address if found to lie in the vsyscall region. The Linux kernel CVE team has assigned CVE-2023-52476 to this issue. Affected and fixed versions =========================== Fixed in 5.15.137 with commit 403d201d1fd1 Fixed in 6.1.59 with commit 386398949765 Fixed in 6.5.8 with commit f71edacbd4f9 Fixed in 6.6 with commit e53899771a02 Please see https://www.kernel.org or a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-52476 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: arch/x86/events/utils.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/403d201d1fd144cb249836dafb222f6375871c6c https://git.kernel.org/stable/c/3863989497652488a50f00e96de4331e5efabc6c https://git.kernel.org/stable/c/f71edacbd4f99c0e12fe4a4007ab4d687d0688db https://git.kernel.org/stable/c/e53899771a02f798d436655efbd9d4b46c0f9265