Executive brief
The Linux kernel's boot process failed to properly disable stack protection in critical early initialization functions, allowing stack canary checks to mismatch and cause kernel panics. This affects systems during startup and could prevent them from booting reliably under certain compiler configurations.
Technical details
The vulnerability exists in the boot_init_stack_canary initialization path, where callers (start_kernel and start_secondary) were not marked with the __no_stack_protector attribute. When compiled with stack protection enabled (without -fno-stack-protector), the stack canary stored in the caller's stack frame would differ from the one initialized in boot_init_stack_canary, causing __stack_chk_fail() to trigger and panic the kernel. The fix applies the __no_stack_protector function attribute (available in GCC 11.1+ and Clang 7.0+) to these early boot functions to prevent stack protector insertion. This is a defensive code hardening fix rather than a true vulnerability patch.
Affected products
- Linux Linux kernel Versions prior to addition of __no_stack_protector attribute (2023)
Timeline
- 2023-04-17: disclosed
- 2023-05-16: patched