Executive brief
A vulnerability in the Linux kernel's x86 architecture handling could allow a local user to cause a system crash. The issue stems from legacy code used for performance monitoring that makes incorrect assumptions about how data is stored in memory. This can lead to memory safety errors that impact the stability and availability of the operating system.
Technical details
The 'profile_pc()' function in arch/x86/kernel/time.c, used for timer-based profiling, makes invalid assumptions about the stack layout when attempting to attribute time spent in spinlocks to their callers. Specifically, it blindly loads words from the stack pointer (regs->sp) or base pointer (regs->bp) to identify return addresses or EFLAGS, which fails when lock debugging or complex stack frames are present. This behavior triggers KASAN (Kernel Address Sanitizer) warnings and can lead to the use of uninitialized resources (CWE-908). The vulnerability is reachable by local users and can result in a kernel panic or system instability. The fix involves removing the legacy stack-walking logic and simply returning the instruction pointer.
Affected products
- Linux Linux Kernel versions up to 4.19.317, 4.20 to 5.4.279, 5.5 to 5.10.221, 5.11 to 5.15.162, 5.16 to 6.1.97, 6.2 to 6.6.37, 6.7 to 6.9.8, 6.10-rc1 to 6.10-rc5
Timeline
- 2024-06-28: patched: Initial patch by Linus Torvalds
- 2024-07-29: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/093d9603b60093a9aaae942db56107f6432a5dca
- https://git.kernel.org/stable/c/161cef818545ecf980f0e2ebaf8ba7326ce53c2b
- https://git.kernel.org/stable/c/16222beb9f8e5ceb0beeb5cbe54bef16df501a92
- https://git.kernel.org/stable/c/27c3be840911b15a3f24ed623f86153c825b6b29
- https://git.kernel.org/stable/c/2d07fea561d64357fb7b3f3751e653bf20306d77
- https://git.kernel.org/stable/c/49c09ca35a5f521d7fa18caf62fdf378f15e8aa4
- https://git.kernel.org/stable/c/65ebdde16e7f5da99dbf8a548fb635837d78384e