From: Michael Neuling <mikey@neuling.org>
To: oss-security@lists.openwall.com
Cc: Michael Ellerman <michael@ellerman.id.au>,
linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org,
Linuxppc-users <linuxppc-users@lists.ozlabs.org>
Subject: CVE-2019-13648: Linux kernel: powerpc: kernel crash in TM handling triggerable by any local user
Date: Tue, 30 Jul 2019 15:01:52 +1000 [thread overview]
Message-ID: <67db82ab73dbb630c45003795f7597274f30983e.camel@neuling.org> (raw)
The Linux kernel for powerpc since v3.9 has a bug in the TM handling where any
unprivileged local user may crash the operating system.
This bug affects machines using 64-bit CPUs where Transactional Memory (TM) is
not present or has been disabled (see below for more details on affected CPUs).
To trigger the bug a process constructs a signal context which still has the MSR
TS bits set. That process then passes this signal context to the sigreturn()
system call. When returning back to userspace, the kernel then crashes with a
bad TM transition (TM Bad Thing) or by executing TM code on a non-TM system.
All 64bit machines where TM is not present are affected. This includes PowerPC
970 (G5), PA6T, POWER5/6/7 VMs under KVM or LPARs under PowerVM and POWER9 bare
metal.
Additionally systems with TM hardware but where TM is disabled in software (via
ppc_tm=off kernel cmdline) are also affected. This includes POWER8/9 VMs under
KVM or LPARs under PowerVM and POWER8 bare metal.
The bug was introduced in commit:
2b0a576d15e0 ("powerpc: Add new transactional memory state to the signal context")
Which was originally merged in v3.9.
The upstream fix is here:
https://git.kernel.org/torvalds/c/f16d80b75a096c52354c6e0a574993f3b0dfbdfe
The fix can be verified by running `sigfuz -m` from the kernel selftests:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/tools/testing/selftests/powerpc/signal/sigfuz.c?h=v5.2
cheers
Mikey
reply other threads:[~2019-07-30 5:03 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=67db82ab73dbb630c45003795f7597274f30983e.camel@neuling.org \
--to=mikey@neuling.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=linuxppc-users@lists.ozlabs.org \
--cc=michael@ellerman.id.au \
--cc=oss-security@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox