In the Linux kernel, the following vulnerability has been resolved:
x86/bugs: Use code segment selector for VERW operand
Robert Gill reported below #GP in 32-bit mode when dosemu software was executing vm86() system call:
general protection fault: 0000 [#1] PREEMPT SMP CPU: 4 PID: 4610 Comm: dosemu.bin Not tainted 6.6.21-gentoo-x86 #1 Hardware name: Dell Inc. PowerEdge 1950/0H723K, BIOS 2.7.0 10/30/2010 EIP: restoreallswitchstack+0xbe/0xcf EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: 00000000 ESI: 00000000 EDI: 00000000 EBP: 00000000 ESP: ff8affdc DS: 0000 ES: 0000 FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010046 CR0: 80050033 CR2: 00c2101c CR3: 04b6d000 CR4: 000406d0 Call Trace: showregs+0x70/0x78 dieaddr+0x29/0x70 excgeneralprotection+0x13c/0x348 excbounds+0x98/0x98 handleexception+0x14d/0x14d excbounds+0x98/0x98 restoreallswitchstack+0xbe/0xcf excbounds+0x98/0x98 restoreallswitch_stack+0xbe/0xcf
This only happens in 32-bit mode when VERW based mitigations like MDS/RFDS are enabled. This is because segment registers with an arbitrary user value can result in #GP when executing VERW. Intel SDM vol. 2C documents the following behavior for VERW instruction:
#GP(0) - If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
CLEARCPUBUFFERS macro executes VERW instruction before returning to user space. Use %cs selector to reference VERW operand. This ensures VERW will not #GP for an arbitrary user %ds.
[ mingo: Fixed the SOB chain. ]
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ada431c6c31a2c8c37991c46089af5caa23a9c6e",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-50072-0c6e9a1e",
"target": {
"file": "arch/x86/include/asm/nospec-branch.h"
},
"digest": {
"line_hashes": [
"335682429436599634776290370469251643956",
"81697818354372352057640870750500522814",
"27276744300271461702138501031965672066",
"287194195567292382873103491321272014863"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc576fbaf82deded606e69a00efe9752136bf91d",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-50072-4e576532",
"target": {
"file": "arch/x86/include/asm/nospec-branch.h"
},
"digest": {
"line_hashes": [
"327379917504149165379773188840525171243",
"142308956853647017339733976703766186043",
"132598672110664949620251675333028097603",
"327541043506181196017333988262604403723"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@481b477ab63c7245715a3e57ba79eb87c2dc0d02",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-50072-88024b41",
"target": {
"file": "arch/x86/include/asm/nospec-branch.h"
},
"digest": {
"line_hashes": [
"327379917504149165379773188840525171243",
"142308956853647017339733976703766186043",
"132598672110664949620251675333028097603",
"327541043506181196017333988262604403723"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4d2102018542e3ae5e297bc6e229303abff8a0f",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-50072-9bb0efbd",
"target": {
"file": "arch/x86/include/asm/nospec-branch.h"
},
"digest": {
"line_hashes": [
"327379917504149165379773188840525171243",
"142308956853647017339733976703766186043",
"132598672110664949620251675333028097603",
"327541043506181196017333988262604403723"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38c5fe74f3bef98f75d16effa49836d50c9b6097",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-50072-df0921b9",
"target": {
"file": "arch/x86/include/asm/nospec-branch.h"
},
"digest": {
"line_hashes": [
"335682429436599634776290370469251643956",
"81697818354372352057640870750500522814",
"27276744300271461702138501031965672066",
"287194195567292382873103491321272014863"
],
"threshold": 0.9
},
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfd1d223d80cb29a210caa1bd5e21f0816d58f02",
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-50072-f4cd29e4",
"target": {
"file": "arch/x86/include/asm/nospec-branch.h"
},
"digest": {
"line_hashes": [
"335682429436599634776290370469251643956",
"81697818354372352057640870750500522814",
"27276744300271461702138501031965672066",
"90693863505036804598349736702446213149"
],
"threshold": 0.9
},
"deprecated": false
}
]