From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A55D42153E8 for ; Wed, 26 Feb 2025 02:13:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536000; cv=none; b=QeD1AO1i+tdg1mXrF3yNMDiu3ZF1ZaQ9ci/cFgUIMUxJek/ZXAYbn/0sMEuNOiDcbL9seA7mfOWJ9bs2Zb1zOZakHs9aw0JmpltgSXXPRYaJXNQmYza7vIuBD/TgWQJkv5j26zGlIaCfya3uxCbwRfKueu6ZpODjxoQqzttkgJA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536000; c=relaxed/simple; bh=3v4vLJtEAhY/KaVbaeCWKiIWOH4Oa5QX7PMoD7AYGNU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=fdyyJC3rbjt9JAXcI1v2MgI8noDP34PXB5yuDEIxe0uR4NAASPSQKOdNzr2NBad9wH+DbMNPVcYpnr5fa6qQ95LrIclYdRWcztCOBhf5hjA3Xa3dLqkXKmBI3gdgXg/HJvqwjixhjbM71p2dwRg5RNbQefwXoRmJ6qUNeeP9Zc8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XxiIr6yV; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="XxiIr6yV" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7C0B3C4CEDD; Wed, 26 Feb 2025 02:13:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740536000; bh=3v4vLJtEAhY/KaVbaeCWKiIWOH4Oa5QX7PMoD7AYGNU=; h=From:To:Cc:Subject:Date:Reply-to:From; b=XxiIr6yViyYtX9Zec/pu659FVoa0kw2JFMPhQy2dcQQHjx2f6lrAct6UEpohw6NIT jJZRcgfDWuquGgehasGCJGFEUI3pDLx4SBZ+3yqTHImDthldXMqjyjEPuewhJ/qp1D YovArQYoZeo3NxtDVcDb1XqFgmpkrpiH8eSiNhyA= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49355: xen: unexport __init-annotated xen_xlate_map_ballooned_pages() Date: Wed, 26 Feb 2025 03:10:29 +0100 Message-ID: <2025022643-CVE-2022-49355-69f7@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=4001; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=3v4vLJtEAhY/KaVbaeCWKiIWOH4Oa5QX7PMoD7AYGNU=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7yp+fu6SdOq9+RkvWzKAr8+rLO4y/vFf+8pvB07Vmk 3+dm8vHjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZiImiDDgptJnPOnGHwKj3t7 ZMolZ81LD2ZaaTAsWHVbwUxHZPckhZ8vHpyL+Oyu5DDvEAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: xen: unexport __init-annotated xen_xlate_map_ballooned_pages() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic. modpost used to detect it, but it has been broken for a decade. Recently, I fixed modpost so it started to warn it again, then this showed up in linux-next builds. There are two ways to fix it: - Remove __init - Remove EXPORT_SYMBOL I chose the latter for this case because none of the in-tree call-sites (arch/arm/xen/enlighten.c, arch/x86/xen/grant-table.c) is compiled as modular. The Linux kernel CVE team has assigned CVE-2022-49355 to this issue. Affected and fixed versions =========================== Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 4.9.321 with commit c0d076419136a7528abc1831847099400f61d60f Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 4.14.286 with commit f319c9b45b351019349cc779ce6721ebc211245c Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 4.19.250 with commit 29a9935a90dd32b89d04e249e0a948cb4949e7af Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 5.4.198 with commit b49c884146e20314808c9420640b26876ff55c80 Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 5.10.122 with commit be9581f4fda795aa0e18cdc333efc1e447e1a55c Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 5.15.47 with commit 40e6078fcf186b4f452abcbffcb004e28d750395 Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 5.17.15 with commit b43387364d8291190fd4ea1322b65c337802baa2 Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 5.18.4 with commit 0ddb4334f4136cd5c84885032894663a4d57928d Issue introduced in 4.8 with commit 243848fc018cb98c2a70c39fe1f93eb266c79835 and fixed in 5.19 with commit dbac14a5a05ff8e1ce7c0da0e1f520ce39ec62ea Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49355 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/xen/xlate_mmu.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c0d076419136a7528abc1831847099400f61d60f https://git.kernel.org/stable/c/f319c9b45b351019349cc779ce6721ebc211245c https://git.kernel.org/stable/c/29a9935a90dd32b89d04e249e0a948cb4949e7af https://git.kernel.org/stable/c/b49c884146e20314808c9420640b26876ff55c80 https://git.kernel.org/stable/c/be9581f4fda795aa0e18cdc333efc1e447e1a55c https://git.kernel.org/stable/c/40e6078fcf186b4f452abcbffcb004e28d750395 https://git.kernel.org/stable/c/b43387364d8291190fd4ea1322b65c337802baa2 https://git.kernel.org/stable/c/0ddb4334f4136cd5c84885032894663a4d57928d https://git.kernel.org/stable/c/dbac14a5a05ff8e1ce7c0da0e1f520ce39ec62ea