In the Linux kernel, the following vulnerability has been resolved:
powerpc/64s: Fix crashes when toggling entry flush barrier
The entry flush mitigation can be enabled/disabled at runtime via a debugfs file (entry_flush), which causes the kernel to patch itself to enable/disable the relevant mitigations.
However depending on which mitigation we're using, it may not be safe to do that patching while other CPUs are active. For example the following crash:
sleeper[15639]: segfault (11) at c000000000004c20 nip c000000000004c20 lr c000000000004c20
Shows that we returned to userspace with a corrupted LR that points into the kernel, due to executing the partially patched call to the fallback entry flush (ie. we missed the LR restore).
Fix it by doing the patching under stop machine. The CPUs that aren't doing the patching will be spinning in the core of the stop machine logic. That is currently sufficient for our purposes, because none of the patching we do is to that code or anywhere in the vicinity.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Feb 28, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 28, 2024 |
| Suse | — | Upgrade kernel-syms-azureUpgrade kernel-obs-buildUpgrade kernel-64kbUpgrade kernel-sourceUpgrade kernel-preemptUpgrade kernel-default-develUpgrade kernel-preempt-develUpgrade kernel-devel-azureUpgrade kernel-azure-baseUpgrade kernel-develUpgrade kernel-source-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-azureUpgrade kernel-azure-develUpgrade kernel-default-baseUpgrade kernel-default-extraUpgrade kernel-defaultUpgrade kernel-macrosUpgrade kernel-symsUpgrade kernel-docsUpgrade kernel-default-manUpgrade kernel-64kb-develUpgrade kernel-zfcpdump | Aug 9, 2024 | Feb 28, 2024 |
| Ubuntu | — | Upgrade linux-image-genericUpgrade linux-image-lowlatencyUpgrade linux-image-4.4.0-253-genericUpgrade linux-image-4.4.0-1168-awsUpgrade linux-image-4.4.0-253-lowlatencyUpgrade linux-image-kvmUpgrade linux-image-awsUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-virtualUpgrade linux-image-4.4.0-1131-kvmUpgrade linux-image-generic-lts-xenialUpgrade linux-image-4.4.0-1130-aws | Apr 22, 2024 | Feb 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub