In the Linux kernel, the following vulnerability has been resolved:
powerpc: Avoid nmienter/nmiexit in real mode interrupt.
nmienter()/nmiexit() touches per cpu variables which can lead to kernel crash when invoked during real mode interrupt handling (e.g. early HMI/MCE interrupt handler) if percpu allocation comes from vmalloc area.
Early HMI/MCE handlers are called through DEFINEINTERRUPTHANDLERNMI() wrapper which invokes nmienter/nmiexit calls. We don't see any issue when percpu allocation is from the embedded first chunk. However with CONFIGNEEDPERCPUPAGEFIRST_CHUNK enabled there are chances where percpu allocation can come from the vmalloc area.
With kernel command line "percpualloc=page" we can force percpu allocation to come from vmalloc area and can see kernel crash in machinecheck_early:
[ 1.215714] NIP [c000000000e49eb4] rcunmienter+0x24/0x110 [ 1.215717] LR [c0000000000461a0] machinecheckearly+0xf0/0x2c0 [ 1.215719] --- interrupt: 200 [ 1.215720] [c000000fffd73180] [0000000000000000] 0x0 (unreliable) [ 1.215722] [c000000fffd731b0] [0000000000000000] 0x0 [ 1.215724] [c000000fffd73210] [c000000000008364] machinecheckearly_common+0x134/0x1f8
Fix this by avoiding use of nmienter()/nmiexit() in real mode if percpu first chunk is not embedded.
{ "vanir_signatures": [ { "id": "CVE-2024-42126-01323a00", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0db880fc865ffb522141ced4bfa66c12ab1fbb70", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "283226548042033907994230908509090561192", "339701404700824064187385461392238838910", "130758277746246528550678571297197789987" ] }, "target": { "file": "arch/powerpc/include/asm/percpu.h" } }, { "id": "CVE-2024-42126-17212188", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c78c9411e685dbc9eac8c2845111b03501975b8", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "283226548042033907994230908509090561192", "339701404700824064187385461392238838910", "130758277746246528550678571297197789987" ] }, "target": { "file": "arch/powerpc/include/asm/percpu.h" } }, { "id": "CVE-2024-42126-2d1d8ebd", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb6675db04c4b79883373edc578d5df7bbc84848", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 348.0, "function_hash": "30527046916240262771566186428016394720" }, "target": { "file": "arch/powerpc/kernel/mce.c", "function": "machine_check_early" } }, { "id": "CVE-2024-42126-4224840b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c78c9411e685dbc9eac8c2845111b03501975b8", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 752.0, "function_hash": "13747998791294241558853538603346146516" }, "target": { "file": "arch/powerpc/include/asm/interrupt.h", "function": "interrupt_nmi_enter_prepare" } }, { "id": "CVE-2024-42126-43c4f080", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb6675db04c4b79883373edc578d5df7bbc84848", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 938.0, "function_hash": "13035511494711906699401763104381699142" }, "target": { "file": "arch/powerpc/kernel/setup_64.c", "function": "setup_per_cpu_areas" } }, { "id": "CVE-2024-42126-7043d508", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb6675db04c4b79883373edc578d5df7bbc84848", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "78741837770440734533207522005618009920", "81084700089068279568965525679297628753", "102275388760461025337459254804325928559", "307168545376077358150205051299827038485", "15689163329226797572478829679531702282", "309230084715985390205480404260173330251", "308491665491262658133965857391643621866" ] }, "target": { "file": "arch/powerpc/kernel/setup_64.c" } }, { "id": "CVE-2024-42126-78bbf148", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0db880fc865ffb522141ced4bfa66c12ab1fbb70", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "92929517206655701031288626818568718010", "62495122501143293697846140483345850171", "269336369216926455634657672911744754902", "40207646021846505516127138818997086663", "230649652576479246684962489025294884441", "256356438152151031917168970555444772510" ] }, "target": { "file": "arch/powerpc/include/asm/interrupt.h" } }, { "id": "CVE-2024-42126-7c7a38dd", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c78c9411e685dbc9eac8c2845111b03501975b8", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 758.0, "function_hash": "190908897175934405286181203175669288075" }, "target": { "file": "arch/powerpc/include/asm/interrupt.h", "function": "interrupt_nmi_exit_prepare" } }, { "id": "CVE-2024-42126-8c3bc71e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c78c9411e685dbc9eac8c2845111b03501975b8", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "92929517206655701031288626818568718010", "62495122501143293697846140483345850171", "269336369216926455634657672911744754902", "40207646021846505516127138818997086663", "230649652576479246684962489025294884441", "256356438152151031917168970555444772510" ] }, "target": { "file": "arch/powerpc/include/asm/interrupt.h" } }, { "id": "CVE-2024-42126-99b6fc2f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb6675db04c4b79883373edc578d5df7bbc84848", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "321425791573948204120985181013116083733", "191956572674471932151361562964041483440", "198301437986979455880742314088254594559", "157501679385274500777381697432287736693", "166210211220012117880281221610218689844", "280564068559318766289103926360951440386", "238128020800814286345364162476710429887", "42482787577066996251585433156515019418" ] }, "target": { "file": "arch/powerpc/kernel/mce.c" } }, { "id": "CVE-2024-42126-a1db706d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0db880fc865ffb522141ced4bfa66c12ab1fbb70", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 758.0, "function_hash": "190908897175934405286181203175669288075" }, "target": { "file": "arch/powerpc/include/asm/interrupt.h", "function": "interrupt_nmi_exit_prepare" } }, { "id": "CVE-2024-42126-b33d51af", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0db880fc865ffb522141ced4bfa66c12ab1fbb70", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 1031.0, "function_hash": "174171492620882688462015802967844930058" }, "target": { "file": "arch/powerpc/kernel/setup_64.c", "function": "setup_per_cpu_areas" } }, { "id": "CVE-2024-42126-b6ce8809", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb6675db04c4b79883373edc578d5df7bbc84848", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 702.0, "function_hash": "295540782637281963626708828575098455474" }, "target": { "file": "arch/powerpc/kernel/traps.c", "function": "machine_check_exception" } }, { "id": "CVE-2024-42126-c981e27b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb6675db04c4b79883373edc578d5df7bbc84848", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "208902917039967884987495739926738451939", "31808569556697387333366267006400309097", "45737829591087695471265600830933245028", "195690227529105394155419136920763700837" ] }, "target": { "file": "arch/powerpc/kernel/traps.c" } }, { "id": "CVE-2024-42126-d06db645", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c78c9411e685dbc9eac8c2845111b03501975b8", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 1031.0, "function_hash": "174171492620882688462015802967844930058" }, "target": { "file": "arch/powerpc/kernel/setup_64.c", "function": "setup_per_cpu_areas" } }, { "id": "CVE-2024-42126-d4b60bc2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb6675db04c4b79883373edc578d5df7bbc84848", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "283226548042033907994230908509090561192", "339701404700824064187385461392238838910", "130758277746246528550678571297197789987" ] }, "target": { "file": "arch/powerpc/include/asm/percpu.h" } }, { "id": "CVE-2024-42126-e0326fd5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c78c9411e685dbc9eac8c2845111b03501975b8", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "284276043210192368131361743655691648608", "128876123576270769348994088942162812589", "335425840084426230178073140316316148726", "251283019897157688010119487903132361985", "103954423696481019192027840335009549646", "309230084715985390205480404260173330251", "308491665491262658133965857391643621866" ] }, "target": { "file": "arch/powerpc/kernel/setup_64.c" } }, { "id": "CVE-2024-42126-f3857759", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0db880fc865ffb522141ced4bfa66c12ab1fbb70", "deprecated": false, "signature_version": "v1", "signature_type": "Function", "digest": { "length": 752.0, "function_hash": "13747998791294241558853538603346146516" }, "target": { "file": "arch/powerpc/include/asm/interrupt.h", "function": "interrupt_nmi_enter_prepare" } }, { "id": "CVE-2024-42126-f474ae16", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0db880fc865ffb522141ced4bfa66c12ab1fbb70", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "284276043210192368131361743655691648608", "128876123576270769348994088942162812589", "335425840084426230178073140316316148726", "251283019897157688010119487903132361985", "103954423696481019192027840335009549646", "309230084715985390205480404260173330251", "308491665491262658133965857391643621866" ] }, "target": { "file": "arch/powerpc/kernel/setup_64.c" } } ] }