In the Linux kernel, the following vulnerability has been resolved:
s390/ptrace: handle setting of fpc register correctly
If the content of the floating point control (fpc) register of a traced process is modified with the ptrace interface the new value is tested for validity by temporarily loading it into the fpc register.
This may lead to corruption of the fpc register of the tracing process: if an interrupt happens while the value is temporarily loaded into the fpc register, and within interrupt context floating point or vector registers are used, the current fp/vx registers are saved with savefpuregs() assuming they belong to user space and will be loaded into fp/vx registers when returning to user space.
testfpctl() restores the original user space fpc register value, however it will be discarded, when returning to user space.
In result the tracer will incorrectly continue to run with the value that was supposed to be used for the traced process.
Fix this by saving fpu register contents with savefpuregs() before using testfpctl().
{ "vanir_signatures": [ { "target": { "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bdce67df7f12fb0409fbc604ce7c4254703f56d4", "digest": { "threshold": 0.9, "line_hashes": [ "261699786570580834301010098398046330531", "109026655757202755369000733122748605712", "128200314589436408245904307962586257690", "225023788641529887245483811467996293274", "206336616165835058481608027204053771352", "165389301134154186227115392139799971647", "221386168897531310826091573832891026129", "52369568966248520008225508418604557850", "163931201022855459485503120186263725911", "132046681134117328442732637020062239964", "139693580987604067216644939601856757088" ] }, "deprecated": false, "id": "CVE-2023-52598-0244aa3e", "signature_type": "Line", "signature_version": "v1" }, { "target": { "function": "__poke_user_compat", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d0822f2cc9b153bf2df49a84599195a2e0d21a8", "digest": { "length": 2000.0, "function_hash": "103796641057142460261283451712363970628" }, "deprecated": false, "id": "CVE-2023-52598-0403efb7", "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "s390_fpregs_set", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bdce67df7f12fb0409fbc604ce7c4254703f56d4", "digest": { "length": 1055.0, "function_hash": "36202274499289806823809355912628273814" }, "deprecated": false, "id": "CVE-2023-52598-19cbecc8", "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "__poke_user_compat", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ccf904aac0292e1f6b1a1be6c407c414f7cf713", "digest": { "length": 2000.0, "function_hash": "103796641057142460261283451712363970628" }, "deprecated": false, "id": "CVE-2023-52598-1d59f0bd", "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "__poke_user", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d0822f2cc9b153bf2df49a84599195a2e0d21a8", "digest": { "length": 1877.0, "function_hash": "169173820291307239146256110568006963062" }, "deprecated": false, "id": "CVE-2023-52598-379b6643", "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "__poke_user_compat", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b13601d19c541158a6e18b278c00ba69ae37829", "digest": { "length": 2278.0, "function_hash": "135470456595335315008042814114555009568" }, "deprecated": false, "id": "CVE-2023-52598-40d6e189", "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "__poke_user_compat", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bdce67df7f12fb0409fbc604ce7c4254703f56d4", "digest": { "length": 2278.0, "function_hash": "135470456595335315008042814114555009568" }, "deprecated": false, "id": "CVE-2023-52598-42993d9d", "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "__poke_user", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bdce67df7f12fb0409fbc604ce7c4254703f56d4", "digest": { "length": 2047.0, "function_hash": "138615455128353081259835132786694307294" }, "deprecated": false, "id": "CVE-2023-52598-55b2adfb", "signature_type": "Function", "signature_version": "v1" }, { "target": { "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@856caf2730ea18cb39e95833719c02a02447dc0a", "digest": { "threshold": 0.9, "line_hashes": [ "24388872152329025856173954181141387108", "186514072532981377058925262790357486807", "56560630621554931023734395007803452645", "36876497473975339630781850882473816278", "45312894828214551026894051008273947077", "166121582893064139478928905452278651503", "221386168897531310826091573832891026129", "52369568966248520008225508418604557850", "163931201022855459485503120186263725911", "132046681134117328442732637020062239964", "139693580987604067216644939601856757088" ] }, "deprecated": false, "id": "CVE-2023-52598-5e039942", "signature_type": "Line", "signature_version": "v1" }, { "target": { "function": "__poke_user_compat", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@856caf2730ea18cb39e95833719c02a02447dc0a", "digest": { "length": 2000.0, "function_hash": "103796641057142460261283451712363970628" }, "deprecated": false, "id": "CVE-2023-52598-889423ba", "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "s390_fpregs_set", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b13601d19c541158a6e18b278c00ba69ae37829", "digest": { "length": 1055.0, "function_hash": "36202274499289806823809355912628273814" }, "deprecated": false, "id": "CVE-2023-52598-98f878d8", "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "__poke_user", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02c6bbfb08bad78dd014e24c7b893723c15ec7a1", "digest": { "length": 2047.0, "function_hash": "138615455128353081259835132786694307294" }, "deprecated": false, "id": "CVE-2023-52598-ba368f31", "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "__poke_user", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ccf904aac0292e1f6b1a1be6c407c414f7cf713", "digest": { "length": 1877.0, "function_hash": "169173820291307239146256110568006963062" }, "deprecated": false, "id": "CVE-2023-52598-ba85fd9b", "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "__poke_user", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@856caf2730ea18cb39e95833719c02a02447dc0a", "digest": { "length": 1877.0, "function_hash": "169173820291307239146256110568006963062" }, "deprecated": false, "id": "CVE-2023-52598-bd23c125", "signature_type": "Function", "signature_version": "v1" }, { "target": { "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b13601d19c541158a6e18b278c00ba69ae37829", "digest": { "threshold": 0.9, "line_hashes": [ "261699786570580834301010098398046330531", "109026655757202755369000733122748605712", "128200314589436408245904307962586257690", "225023788641529887245483811467996293274", "206336616165835058481608027204053771352", "165389301134154186227115392139799971647", "221386168897531310826091573832891026129", "52369568966248520008225508418604557850", "163931201022855459485503120186263725911", "132046681134117328442732637020062239964", "139693580987604067216644939601856757088" ] }, "deprecated": false, "id": "CVE-2023-52598-c117f185", "signature_type": "Line", "signature_version": "v1" }, { "target": { "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02c6bbfb08bad78dd014e24c7b893723c15ec7a1", "digest": { "threshold": 0.9, "line_hashes": [ "261699786570580834301010098398046330531", "109026655757202755369000733122748605712", "128200314589436408245904307962586257690", "225023788641529887245483811467996293274", "206336616165835058481608027204053771352", "165389301134154186227115392139799971647", "221386168897531310826091573832891026129", "52369568966248520008225508418604557850", "163931201022855459485503120186263725911", "132046681134117328442732637020062239964", "139693580987604067216644939601856757088" ] }, "deprecated": false, "id": "CVE-2023-52598-c35ff84e", "signature_type": "Line", "signature_version": "v1" }, { "target": { "function": "s390_fpregs_set", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@856caf2730ea18cb39e95833719c02a02447dc0a", "digest": { "length": 1055.0, "function_hash": "36202274499289806823809355912628273814" }, "deprecated": false, "id": "CVE-2023-52598-c6e39f5c", "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "s390_fpregs_set", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d0822f2cc9b153bf2df49a84599195a2e0d21a8", "digest": { "length": 1055.0, "function_hash": "36202274499289806823809355912628273814" }, "deprecated": false, "id": "CVE-2023-52598-cf0cea47", "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "__poke_user_compat", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02c6bbfb08bad78dd014e24c7b893723c15ec7a1", "digest": { "length": 2278.0, "function_hash": "135470456595335315008042814114555009568" }, "deprecated": false, "id": "CVE-2023-52598-d850419b", "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "__poke_user", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b13601d19c541158a6e18b278c00ba69ae37829", "digest": { "length": 2047.0, "function_hash": "138615455128353081259835132786694307294" }, "deprecated": false, "id": "CVE-2023-52598-df9528c4", "signature_type": "Function", "signature_version": "v1" }, { "target": { "function": "s390_fpregs_set", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02c6bbfb08bad78dd014e24c7b893723c15ec7a1", "digest": { "length": 1055.0, "function_hash": "36202274499289806823809355912628273814" }, "deprecated": false, "id": "CVE-2023-52598-ed4af6c8", "signature_type": "Function", "signature_version": "v1" }, { "target": { "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d0822f2cc9b153bf2df49a84599195a2e0d21a8", "digest": { "threshold": 0.9, "line_hashes": [ "24388872152329025856173954181141387108", "186514072532981377058925262790357486807", "56560630621554931023734395007803452645", "36876497473975339630781850882473816278", "45312894828214551026894051008273947077", "166121582893064139478928905452278651503", "221386168897531310826091573832891026129", "52369568966248520008225508418604557850", "163931201022855459485503120186263725911", "132046681134117328442732637020062239964", "139693580987604067216644939601856757088" ] }, "deprecated": false, "id": "CVE-2023-52598-f034643b", "signature_type": "Line", "signature_version": "v1" }, { "target": { "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ccf904aac0292e1f6b1a1be6c407c414f7cf713", "digest": { "threshold": 0.9, "line_hashes": [ "24388872152329025856173954181141387108", "186514072532981377058925262790357486807", "56560630621554931023734395007803452645", "36876497473975339630781850882473816278", "45312894828214551026894051008273947077", "166121582893064139478928905452278651503", "221386168897531310826091573832891026129", "52369568966248520008225508418604557850", "163931201022855459485503120186263725911", "132046681134117328442732637020062239964", "139693580987604067216644939601856757088" ] }, "deprecated": false, "id": "CVE-2023-52598-f356cb85", "signature_type": "Line", "signature_version": "v1" }, { "target": { "function": "s390_fpregs_set", "file": "arch/s390/kernel/ptrace.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ccf904aac0292e1f6b1a1be6c407c414f7cf713", "digest": { "length": 1055.0, "function_hash": "36202274499289806823809355912628273814" }, "deprecated": false, "id": "CVE-2023-52598-f78cd962", "signature_type": "Function", "signature_version": "v1" } ] }