In the Linux kernel, the following vulnerability has been resolved:
powerpc/64s: fix program check interrupt emergency stack path
Emergency stack path was jumping into a 3: label inside the __GEN_COMMON_BODY macro for the normal path after it had finished, rather than jumping over it. By a small miracle this is the correct place to build up a new interrupt frame with the existing stack pointer, so things basically worked okay with an added weird looking 700 trap frame on top (which had the wrong ->nip so it didn't decode bug messages either).
Fix this by avoiding using numeric labels when jumping over non-trivial macros.
Before:
LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV Modules linked in: CPU: 0 PID: 88 Comm: sh Not tainted 5.15.0-rc2-00034-ge057cdade6e5 #2637 NIP: 7265677368657265 LR: c00000000006c0c8 CTR: c0000000000097f0 REGS: c0000000fffb3a50 TRAP: 0700 Not tainted MSR: 9000000000021031 <SF,HV,ME,IR,DR,LE> CR: 00000700 XER: 20040000 CFAR: c0000000000098b0 IRQMASK: 0 GPR00: c00000000006c964 c0000000fffb3cf0 c000000001513800 0000000000000000 GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299 GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8 GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001 GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8 GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158 GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300 GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80 NIP [7265677368657265] 0x7265677368657265 LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10 Call Trace: [c0000000fffb3cf0] [c00000000000bdac] soft_nmi_common+0x13c/0x1d0 (unreliable) --- interrupt: 700 at decrementer_common_virt+0xb8/0x230 NIP: c0000000000098b8 LR: c00000000006c0c8 CTR: c0000000000097f0 REGS: c0000000fffb3d60 TRAP: 0700 Not tainted MSR: 9000000000021031 <SF,HV,ME,IR,DR,LE> CR: 22424282 XER: 20040000 CFAR: c0000000000098b0 IRQMASK: 0 GPR00: c00000000006c964 0000000000002400 c000000001513800 0000000000000000 GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299 GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8 GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001 GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8 GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158 GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300 GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80 NIP [c0000000000098b8] decrementer_common_virt+0xb8/0x230 LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10 --- interrupt: 700 Instruction dump: XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX ---[ end trace 6d28218e0cc3c949 ]---
After:
------------[ cut here ]------------ kernel BUG at arch/powerpc/kernel/exceptions-64s.S:491! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV Modules linked in: CPU: 0 PID: 88 Comm: login Not tainted 5.15.0-rc2-00034-ge057cdade6e5-dirty #2638 NIP: c0000000000098b8 LR: c00000000006bf04 CTR: c0000000000097f0 REGS: c0000000fffb3d60 TRAP: 0700 Not tainted MSR: 9000000000021031 <SF,HV,ME,IR,DR,LE> CR: 24482227 XER: 00040000 CFAR: c0000000000098b0 IRQMASK: 0 GPR00: c00000000006bf04 0000000000002400 c000000001513800 c000000001271868 GPR04: 00000000100f0d29 0000000042000000 0000000000000007 0000000000000009 GPR08: 00000000100f0d29 0000000024482227 0000000000002710 c000000000181b3c GPR12: 9000000000009033 c0000000016b0000 00000000100f0d29 c000000005b22f00 GPR16: 00000000ffff0000 0000000000000001 0000000000000009 00000000100eed90 GPR20: 00000000100eed90 00000 ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Dec 5, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-symsUpgrade dtb-amazonUpgrade kernel-debug-livepatch-develUpgrade dtb-lgUpgrade kernel-syms-rtUpgrade dtb-freescaleUpgrade kernel-kvmsmallUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-hisiliconUpgrade gfs2-kmp-64kbUpgrade dtb-apmUpgrade kernel-syms-azureUpgrade kernel-64kbUpgrade dtb-armUpgrade kernel-debugUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-defaultUpgrade kernel-default-extraUpgrade dlm-kmp-azureUpgrade kernel-azure-vdsoUpgrade dtb-amlogicUpgrade dlm-kmp-64kbUpgrade dtb-mediatekUpgrade kernel-preemptUpgrade kernel-obs-qaUpgrade dtb-exynosUpgrade kernel-rt-develUpgrade kernel-rtUpgrade cluster-md-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-devel-azureUpgrade kernel-azure-develUpgrade kernel-rt_debugUpgrade kernel-azure-extraUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-rtUpgrade kernel-devel-rtUpgrade kernel-sourceUpgrade kernel-macrosUpgrade kernel-64kb-livepatch-develUpgrade kernel-zfcpdumpUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-64kbUpgrade kernel-64kb-develUpgrade kernel-source-azureUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-optionalUpgrade dtb-appleUpgrade kernel-default-develUpgrade kernel-azure-livepatch-develUpgrade dtb-qcomUpgrade dtb-marvellUpgrade dlm-kmp-rtUpgrade kernel-default-optionalUpgrade kernel-default-baseUpgrade kernel-rt-vdsoUpgrade dtb-broadcomUpgrade kernel-obs-buildUpgrade kernel-source-vanillaUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-vdsoUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-livepatchUpgrade kernel-docs-htmlUpgrade dtb-rockchipUpgrade kernel-docsUpgrade kernel-develUpgrade dtb-renesasUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade kernel-defaultUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-azureUpgrade gfs2-kmp-azureUpgrade dtb-nvidiaUpgrade ocfs2-kmp-64kbUpgrade kernel-default-livepatchUpgrade dtb-caviumUpgrade kernel-rt-extraUpgrade cluster-md-kmp-rtUpgrade dtb-socionextUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-debug-develUpgrade dtb-alteraUpgrade dtb-allwinnerUpgrade dtb-xilinxUpgrade dtb-sprdUpgrade ocfs2-kmp-azureUpgrade kernel-source-rtUpgrade kernel-azure-optionalUpgrade kernel-preempt-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kb-extraUpgrade dtb-amdUpgrade kernel-azureUpgrade kernel-rt-optionalUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-default | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub