In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: Don't unset window if it was never set On pSeries, when user attempts to use the same vfio container used by different iommu group, the spaprtcesetwindow() returns -EPERM and the subsequent cleanup leads to the below crash. Kernel attempted to read user page (308) - exploit attempt? BUG: Kernel NULL pointer dereference on read at 0x00000308 Faulting instruction address: 0xc0000000001ce358 Oops: Kernel access of bad area, sig: 11 [#1] NIP: c0000000001ce358 LR: c0000000001ce05c CTR: c00000000005add0 <snip> NIP [c0000000001ce358] spaprtceunsetwindow+0x3b8/0x510 LR [c0000000001ce05c] spaprtceunsetwindow+0xbc/0x510 Call Trace: spaprtceunsetwindow+0xbc/0x510 (unreliable) tceiommuattachgroup+0x24c/0x340 [vfioiommuspaprtce] vfiocontainerattachgroup+0xec/0x240 [vfio] vfiogroupfopsunlioctl+0x548/0xb00 [vfio] sysioctl+0x754/0x1580 systemcallexception+0x13c/0x330 systemcallvectoredcommon+0x15c/0x2ec <snip> --- interrupt: 3000 Fix this by having null check for the tbl passed to the spaprtceunsetwindow().
{ "binaries": [ { "binary_name": "linux-azure-6.11-cloud-tools-6.11.0-1015", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-azure-6.11-headers-6.11.0-1015", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-azure-6.11-tools-6.11.0-1015", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-buildinfo-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-cloud-tools-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-azure-dbgsym", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-extra-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1015-azure", "binary_version": "6.11.0-1015.15~24.04.1" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-buildinfo-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-gcp-6.11-headers-6.11.0-1015", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-gcp-6.11-lib-rust-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-gcp-6.11-tools-6.11.0-1015", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-64k-dbgsym", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-dbgsym", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-extra-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-modules-extra-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1015-gcp", "binary_version": "6.11.0-1015.15~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1015-gcp-64k", "binary_version": "6.11.0-1015.15~24.04.1" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-buildinfo-6.11.0-26-generic-64k", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-cloud-tools-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-headers-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-headers-6.11.0-26-generic-64k", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-hwe-6.11-cloud-tools-6.11.0-26", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-hwe-6.11-headers-6.11.0-26", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-hwe-6.11-lib-rust-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-hwe-6.11-tools-6.11.0-26", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-6.11.0-26-generic-dbgsym", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-26-generic-64k", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-26-generic-64k-dbgsym", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-26-generic-dbgsym", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-6.11.0-26-generic-64k", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-extra-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-ipu6-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-ipu7-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-usbio-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-modules-vision-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-tools-6.11.0-26-generic", "binary_version": "6.11.0-26.26~24.04.1" }, { "binary_name": "linux-tools-6.11.0-26-generic-64k", "binary_version": "6.11.0-26.26~24.04.1" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-buildinfo-6.11.0-1014-lowlatency-64k", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-cloud-tools-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-headers-6.11.0-1014-lowlatency-64k", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-64k", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-64k-dbgsym", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-dbgsym", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-lowlatency-hwe-6.11-cloud-tools-6.11.0-1014", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-lowlatency-hwe-6.11-headers-6.11.0-1014", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-lowlatency-hwe-6.11-lib-rust-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-lowlatency-hwe-6.11-tools-6.11.0-1014", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-modules-6.11.0-1014-lowlatency-64k", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1014-lowlatency", "binary_version": "6.11.0-1014.15~24.04.1" }, { "binary_name": "linux-tools-6.11.0-1014-lowlatency-64k", "binary_version": "6.11.0-1014.15~24.04.1" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-headers-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-image-unsigned-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-image-unsigned-6.11.0-1022-oem-dbgsym", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-ipu6-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-ipu7-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-iwlwifi-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-usbio-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-modules-vision-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-oem-6.11-headers-6.11.0-1022", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-oem-6.11-tools-6.11.0-1022", "binary_version": "6.11.0-1022.22" }, { "binary_name": "linux-tools-6.11.0-1022-oem", "binary_version": "6.11.0-1022.22" } ], "availability": "No subscription required" }