CVE-2024-56678

In the Linux kernel, the following vulnerability has been resolved:

powerpc/mm/fault: Fix kfence page fault reporting

copyfromkernelnofault() can be called when doing read of /proc/kcore. /proc/kcore can have some unmapped kfence objects which when read via copyfromkernelnofault() can cause page faults. Since *_nofault() functions define their own fixup table for handling fault, use that instead of asking kfence to handle such faults.

Hence we search the exception tables for the nip which generated the fault. If there is an entry then we let the fixup table handler handle the page fault by returning an error from within _dopagefault().

This can be easily triggered if someone tries to do dd from /proc/kcore. eg. dd if=/proc/kcore of=/dev/null bs=1M

Some example false negatives:

=============================== BUG: KFENCE: invalid read in copyfromkernelnofault+0x9c/0x1a0 Invalid read at 0xc0000000fdff0000: copyfromkernelnofault+0x9c/0x1a0 0xc00000000665f950 readkcoreiter+0x57c/0xa04 procregreaditer+0xe4/0x16c vfsread+0x320/0x3ec ksysread+0x90/0x154 systemcallexception+0x120/0x310 systemcallvectoredcommon+0x15c/0x2ec

BUG: KFENCE: use-after-free read in copyfromkernelnofault+0x9c/0x1a0 Use-after-free read at 0xc0000000fe050000 (in kfence-#2): copyfromkernelnofault+0x9c/0x1a0 0xc00000000665f950 readkcoreiter+0x57c/0xa04 procregreaditer+0xe4/0x16c vfsread+0x320/0x3ec ksysread+0x90/0x154 systemcallexception+0x120/0x310 systemcallvectoredcommon+0x15c/0x2ec