From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B4A211B87E2 for ; Wed, 16 Apr 2025 14:14:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744812878; cv=none; b=dNNWAhvLqE3q1NmSa+dKw6WK17EoKpRixEwBORM5r8b5GhuiGHd3ZpzXrn5eyT+ZjyPI2/FRTpaKAn+3H4TrQ9YUS4qAdYog54c4J8epKqmFwX+5S+t/LRziwXsZSIg2p/AtGqTRMpcEXgD8Les8GPp+DT/HQzQ/N6AjMu8ncB4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744812878; c=relaxed/simple; bh=HgMeuUZkZZONEyLOBHyUz9+Lpx+SMOzU0rotaY/9oXo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=RGi7EaMufPC2mmUZdeHK0aM4h0O5fxG5lJs1MggGG2rJ1BY3FyCEe+qH6YidOPQe8zJ1GhZCwDHk/CVhR58+KZHbQR36s0V7Bx1wg+8jxdyMqIujNe5PCXC/HwhZwNk7CZI67MwKJU+K0v5HPHRuxXkk3kdKJo1g65dnGRXf61c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=MxEWcIbh; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="MxEWcIbh" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E3A87C4CEE2; Wed, 16 Apr 2025 14:14:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1744812878; bh=HgMeuUZkZZONEyLOBHyUz9+Lpx+SMOzU0rotaY/9oXo=; h=From:To:Cc:Subject:Date:Reply-to:From; b=MxEWcIbhjA2BTNTJB1MscNNUbWEfs/FsB94+5PWINb8VWig5h24WU0BYUznjc14Ty YMJgJhkYWpWm4g4O9iAVvZKHi2jII6HrRowefmLcx9dJmnaciNSveKMMxF/kqzRa/M y5KHGnAj9cM3fj9OIbjFsSnih++0U0ZWSrESR2vc= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2025-22047: x86/microcode/AMD: Fix __apply_microcode_amd()'s return value Date: Wed, 16 Apr 2025 16:12:18 +0200 Message-ID: <2025041602-CVE-2025-22047-9cc8@gregkh> X-Mailer: git-send-email 2.49.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2624; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=HgMeuUZkZZONEyLOBHyUz9+Lpx+SMOzU0rotaY/9oXo=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn/d22Kuj3l+p1KC50bxq1SYTO2l3b9UJK5NDf1nmuRd X62vc3mjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZjIGVmG+Z6hgWmz6/e9nszv t8XTb9Y8UaHt5QwLdviEd1X4Cp84Hsr8ZdKxec9FVKS5AA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix __apply_microcode_amd()'s return value When verify_sha256_digest() fails, __apply_microcode_amd() should propagate the failure by returning false (and not -1 which is promoted to true). The Linux kernel CVE team has assigned CVE-2025-22047 to this issue. Affected and fixed versions =========================== Issue introduced in 6.6.81 with commit bef830144febedb7de86863ae99d8f53bed76e95 and fixed in 6.6.87 with commit 763f4d638f71cb45235395790a46e9f9e84227fd Issue introduced in 6.12.18 with commit 3e8653e399e7111a3e87d534ff4533b250ae574f and fixed in 6.12.23 with commit ada88219d5315fc13f2910fe278c7112d8d68889 Issue introduced in 6.13.6 with commit c162ba4f45ab6ef3b7114af6fb419f1833f050c0 and fixed in 6.13.11 with commit d295c58fad1d5ab987a81f139dd21498732c4f13 Issue introduced in 6.14 with commit 50cef76d5cb0e199cda19f026842560f6eedc4f7 and fixed in 6.14.2 with commit 7f705a45f130a85fbf31c2abdc999c65644c8307 Issue introduced in 6.14 with commit 50cef76d5cb0e199cda19f026842560f6eedc4f7 and fixed in 6.15-rc1 with commit 31ab12df723543047c3fc19cb8f8c4498ec6267f Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-22047 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: arch/x86/kernel/cpu/microcode/amd.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/763f4d638f71cb45235395790a46e9f9e84227fd https://git.kernel.org/stable/c/ada88219d5315fc13f2910fe278c7112d8d68889 https://git.kernel.org/stable/c/d295c58fad1d5ab987a81f139dd21498732c4f13 https://git.kernel.org/stable/c/7f705a45f130a85fbf31c2abdc999c65644c8307 https://git.kernel.org/stable/c/31ab12df723543047c3fc19cb8f8c4498ec6267f