In the Linux kernel, the following vulnerability has been resolved:
KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()
In commit 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C") kvm_start_guest() became idle_kvm_start_guest(). The old code allocated a stack frame on the emergency stack, but didn't use the frame to store anything, and also didn't store anything in its caller's frame.
idle_kvm_start_guest() on the other hand is written more like a normal C function, it creates a frame on entry, and also stores CR/LR into its callers frame (per the ABI). The problem is that there is no caller frame on the emergency stack.
The emergency stack for a given CPU is allocated with:
paca_ptrs[i]->emergency_sp = alloc_stack(limit, i) + THREAD_SIZE;
So emergency_sp actually points to the first address above the emergency stack allocation for a given CPU, we must not store above it without first decrementing it to create a frame. This is different to the regular kernel stack, paca->kstack, which is initialised to point at an initial frame that is ready to use.
idle_kvm_start_guest() stores the backchain, CR and LR all of which write outside the allocation for the emergency stack. It then creates a stack frame and saves the non-volatile registers. Unfortunately the frame it creates is not large enough to fit the non-volatiles, and so the saving of the non-volatile registers also writes outside the emergency stack allocation.
The end result is that we corrupt whatever is at 0-24 bytes, and 112-248 bytes above the emergency stack allocation.
In practice this has gone unnoticed because the memory immediately above the emergency stack happens to be used for other stack allocations, either another CPUs mc_emergency_sp or an IRQ stack. See the order of calls to irqstack_early_init() and emergency_stack_init().
The low addresses of another stack are the top of that stack, and so are only used if that stack is under extreme pressue, which essentially never happens in practice - and if it did there's a high likelyhood we'd crash due to that stack overflowing.
Still, we shouldn't be corrupting someone else's stack, and it is purely luck that we aren't corrupting something else.
To fix it we save CR/LR into the caller's frame using the existing r1 on entry, we then create a SWITCH_FRAME_SIZE frame (which has space for pt_regs) on the emergency stack with the backchain pointing to the existing stack, and then finally we switch to the new frame on the emergency stack.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 22, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 22, 2024 |
| Suse | — | Upgrade dtb-broadcomUpgrade dtb-freescaleUpgrade dlm-kmp-rtUpgrade dtb-alteraUpgrade kernel-source-azureUpgrade kernel-preemptUpgrade kernel-rt-optionalUpgrade dtb-amazonUpgrade cluster-md-kmp-azureUpgrade kernel-preempt-develUpgrade kernel-develUpgrade kernel-docs-htmlUpgrade kernel-debugUpgrade kernel-rt_debug-livepatch-develUpgrade gfs2-kmp-defaultUpgrade kernel-rt-extraUpgrade cluster-md-kmp-64kbUpgrade kernel-default-livepatchUpgrade cluster-md-kmp-rtUpgrade dtb-hisiliconUpgrade dtb-lgUpgrade kernel-default-base-rebuildUpgrade kernel-64kb-extraUpgrade kernel-rt_debug-develUpgrade kernel-azureUpgrade kernel-default-optionalUpgrade kernel-rtUpgrade ocfs2-kmp-64kbUpgrade dtb-xilinxUpgrade kernel-default-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-sprdUpgrade dlm-kmp-64kbUpgrade kernel-syms-azureUpgrade ocfs2-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-64kbUpgrade kernel-rt-vdsoUpgrade kernel-debug-vdsoUpgrade kernel-source-rtUpgrade kernel-64kb-develUpgrade kselftests-kmp-azureUpgrade kernel-default-develUpgrade dtb-exynosUpgrade gfs2-kmp-azureUpgrade dtb-renesasUpgrade dtb-allwinnerUpgrade kernel-source-vanillaUpgrade kernel-64kb-optionalUpgrade ocfs2-kmp-azureUpgrade kernel-obs-buildUpgrade kernel-rt-develUpgrade kernel-sourceUpgrade dtb-qcomUpgrade kernel-rt-livepatchUpgrade reiserfs-kmp-defaultUpgrade dtb-caviumUpgrade kselftests-kmp-64kbUpgrade kernel-azure-optionalUpgrade kernel-azure-extraUpgrade kernel-azure-develUpgrade kernel-rt_debugUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-extraUpgrade kernel-kvmsmallUpgrade kernel-docsUpgrade dtb-amlogicUpgrade ocfs2-kmp-rtUpgrade kernel-azure-livepatch-develUpgrade kernel-debug-develUpgrade kernel-devel-azureUpgrade dtb-nvidiaUpgrade dtb-amdUpgrade kernel-azure-vdsoUpgrade dlm-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-devel-rtUpgrade reiserfs-kmp-azureUpgrade dtb-mediatekUpgrade dlm-kmp-azureUpgrade dtb-socionextUpgrade dtb-rockchipUpgrade cluster-md-kmp-defaultUpgrade dtb-appleUpgrade kernel-rt-livepatch-develUpgrade kernel-default-baseUpgrade kselftests-kmp-defaultUpgrade dtb-marvellUpgrade reiserfs-kmp-rtUpgrade dtb-armUpgrade gfs2-kmp-rtUpgrade kernel-debug-livepatch-develUpgrade kernel-macrosUpgrade kernel-rt_debug-vdsoUpgrade dtb-apmUpgrade kernel-kvmsmall-develUpgrade kernel-symsUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-64kbUpgrade kernel-syms-rtUpgrade kernel-obs-qaUpgrade kernel-defaultUpgrade kselftests-kmp-rt | Aug 9, 2024 | May 22, 2024 |
| Ubuntu | — | Upgrade linux-fipsUpgrade linux-gkeopUpgrade linux-hwe-5.4Upgrade linux-kvmUpgrade linux-aws-5.4Upgrade linux-ibmUpgrade linux-oracleUpgrade linux-oracle-5.4Upgrade linux-azure-fipsUpgrade linux-raspiUpgrade linux-aws-fipsUpgrade linux-gcp-5.4Upgrade linux-azureUpgrade linux-gcp-fipsUpgrade linux-gcpUpgrade linux-bluefieldUpgrade linux-awsUpgrade linux-azure-5.4Upgrade linuxUpgrade linux-raspi-5.4 | Nov 19, 2024 | May 22, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub