Executive brief
The Linux kernel's AMD machine check exception (MCE) handler uses a 32-bit integer to track which of up to 64 CPU error-reporting banks are active. This causes an integer overflow when accessing banks numbered 32 and above, potentially leading to incorrect error handling or kernel crashes on AMD processors with many memory banks.
Technical details
This is an integer overflow vulnerability in the AMD MCE (Machine Check Exception) handler in arch/x86/kernel/cpu/mce/amd.c. The bank_map variable, used to store a bitmask of which MCA (Machine Check Architecture) banks to initialize, was declared as an unsigned int (32-bit) while the system supports up to 64 banks (MAX_NR_BANKS). When shift operations attempted to set bits numbered 32 or higher, undefined behavior occurred, triggering UBSAN (Undefined Behavior Sanitizer) warnings and potentially causing incorrect error handling. The fix changes bank_map and related variables from unsigned int/u32 to u64, and uses the BIT_ULL() macro instead of BIT() for 64-bit operations. This affects systems running vulnerable Linux kernels with AMD processors that expose 32 or more MCA banks, though exploitation requires specific hardware configuration and is not known to be exploited in the wild.
Affected products
- Linux Linux kernel affected versions prior to commit 4c1cdec319b9aadb65737c3eb1f5cb74bd6aa156
Timeline
- 2023-01-27: disclosed
- 2023-03-19: patched
- 2023-05-11: other: backported to stable kernel series