Executive brief
A vulnerability in the Linux kernel's memory management for x86 systems could allow a local user to cause a system crash. By using a BPF program to read from a specific legacy memory area (the vsyscall page), an attacker can trigger an unhandled kernel exception. This results in a 'kernel oops' or system hang, impacting the availability of the affected server or workstation.
Technical details
The vulnerability exists in the x86 memory management component of the Linux kernel. When a BPF program uses 'bpf_probe_read_kernel()' to access the vsyscall page, it invokes 'copy_from_kernel_nofault()'. Because the vsyscall page is not readable from kernel space, a page fault is triggered. However, 'handle_page_fault()' incorrectly identifies the vsyscall address as user space rather than kernel space, preventing the BPF fix-up mechanism from executing. This leads to a 'page_fault_oops()' due to Supervisor Mode Access Prevention (SMAP) violations. The fix involves explicitly disallowing vsyscall page reads within 'copy_from_kernel_nofault_allowed()'.
Affected products
- Linux Linux Kernel up to 5.10.214, 5.11 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8-rc1 to 6.8-rc5
Timeline
- 2024-04-17: advisory: NVD publication date
- 2024-02-15: patched: Mainline kernel patch committed
References
- https://git.kernel.org/stable/c/29bd6f86904682adafe9affbc7f79b14defcaff8
- https://git.kernel.org/stable/c/32019c659ecfe1d92e3bf9fcdfbb11a7c70acd58
- https://git.kernel.org/stable/c/57f78c46f08198e1be08ffe99c4c1ccc12855bf5
- https://git.kernel.org/stable/c/6e4694e65b6db4c3de125115dd4f55848cc48381
- https://git.kernel.org/stable/c/e8a67fe34b76a49320b33032228a794f40b0316b
- https://git.kernel.org/stable/c/f175de546a3eb77614d94d4c02550181c0a8493e
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html