In the Linux kernel, the following vulnerability has been resolved:
efivarfs: force RO when remounting if SetVariable is not supported
If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a crash looking like this:
$ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK
[ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04: level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr : efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [ 303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [ 303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [ 303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code: ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]---
Fix this by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and deny anything that's not RO if the firmware doesn't implement SetVariable at runtime.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade bpftoolUpgrade kernel-64k-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-coreUpgrade kernel-64k-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-64k-develUpgrade kernel-develUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-develUpgrade kernel-64k-debug-develUpgrade rtlaUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-rt-debugUpgrade kernel-rt-modules-coreUpgrade kernel-rt-kvmUpgrade kernel-debug-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-uki-virtUpgrade kernel-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-debug-develUpgrade kernel-64k-modulesUpgrade kernel-rt-coreUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-develUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-modulesUpgrade kernel-64kUpgrade kernel-debugUpgrade libperfUpgrade kernel-64k-modules-extraUpgrade kernel-64k-debug-modules-extraUpgrade kernel-modules-coreUpgrade python3-perfUpgrade kernel-rt-modules-extraUpgrade kernel-rtUpgrade kernel-zfcpdump-coreUpgrade perfUpgrade rvUpgrade kernel-64k-debug-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-tools-libs-develUpgrade kernelUpgrade kernel-64k-debugUpgrade kernel-headersUpgrade kernel-cross-headersUpgrade kernel-debug-devel-matchedUpgrade kernel-devel-matchedUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-doc | Aug 12, 2024 | Feb 23, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade python-perfUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.15.148-97.158Upgrade perfUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.209-198.812Upgrade kernel-debuginfo-common-aarch64Upgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-develUpgrade kernel-tools-devel | Mar 19, 2024 | Feb 23, 2024 |
| Amazon_linux_2023 | — | Upgrade perf-debuginfoUpgrade perfUpgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headersUpgrade kernel-libbpfUpgrade kernel-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel-libbpf-staticUpgrade kernel-tools-develUpgrade kernel-modules-extra-commonUpgrade kernel-livepatch-6.1.75-99.163Upgrade kernelUpgrade python3-perf-debuginfoUpgrade python3-perfUpgrade kernel-libbpf-develUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64 | Feb 17, 2025 | Feb 23, 2024 |
| Debian | — | Upgrade linux | Jun 27, 2024 | Feb 23, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-tools | Jun 3, 2024 | Feb 23, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernelUpgrade python3-perf | Jul 1, 2024 | Feb 23, 2024 |
| Oracle_linux | — | Upgrade kernel | Aug 16, 2024 | Feb 23, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Aug 12, 2024 | Feb 23, 2024 |
| Rocky_linux | — | Upgrade kernel-debug-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libs-develUpgrade kernel-modules-coreUpgrade bpftool-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-cross-headersUpgrade kernelUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debug-devel-matchedUpgrade libperfUpgrade kernel-rtUpgrade kernel-debug-debuginfoUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-kvmUpgrade kernel-tools-libsUpgrade kernel-rt-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-modulesUpgrade kernel-rt-debug-develUpgrade libperf-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-modulesUpgrade kernel-headersUpgrade kernel-devel-matchedUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-coreUpgrade kernel-rt-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade python3-perf-debuginfoUpgrade kernel-rt-modulesUpgrade bpftoolUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade rvUpgrade kernel-uki-virtUpgrade kernel-debugUpgrade kernel-rt-debugUpgrade kernel-modules-extraUpgrade perf-debuginfoUpgrade python3-perfUpgrade kernel-toolsUpgrade perfUpgrade kernel-rt-kvmUpgrade kernel-debug-develUpgrade rtlaUpgrade kernel-debuginfoUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-debuginfo | Aug 22, 2024 | Feb 23, 2024 |
| Suse | — | Upgrade gfs2-kmp-defaultUpgrade kernel-azureUpgrade kernel-develUpgrade dtb-caviumUpgrade dtb-sprdUpgrade kernel-debugUpgrade kernel-default-livepatch-develUpgrade kernel-rt-livepatchUpgrade dlm-kmp-rtUpgrade dtb-hisiliconUpgrade kernel-64kb-optionalUpgrade dtb-xilinxUpgrade kernel-64kb-extraUpgrade dtb-amdUpgrade kernel-defaultUpgrade kernel-default-vdsoUpgrade kernel-default-livepatchUpgrade kernel-preempt-develUpgrade kernel-rt_debug-develUpgrade kernel-default-optionalUpgrade reiserfs-kmp-rtUpgrade cluster-md-kmp-rtUpgrade kernel-devel-rtUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-defaultUpgrade dtb-renesasUpgrade cluster-md-kmp-64kbUpgrade kernel-azure-extraUpgrade kernel-64kb-develUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade dtb-alteraUpgrade gfs2-kmp-azureUpgrade dtb-mediatekUpgrade kernel-rt-develUpgrade kernel-default-baseUpgrade kselftests-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-debug-develUpgrade reiserfs-kmp-azureUpgrade kernel-symsUpgrade kernel-azure-optionalUpgrade kselftests-kmp-azureUpgrade kernel-source-vanillaUpgrade dlm-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-appleUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-nvidiaUpgrade dtb-exynosUpgrade kernel-rt_debugUpgrade kernel-syms-rtUpgrade kernel-syms-azureUpgrade kernel-kvmsmallUpgrade kernel-64kb-livepatch-develUpgrade kernel-64kbUpgrade dtb-apmUpgrade ocfs2-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-docs-htmlUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-rtUpgrade dtb-broadcomUpgrade kernel-obs-qaUpgrade dtb-amazonUpgrade dtb-armUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-default-extraUpgrade dtb-socionextUpgrade kernel-default-base-rebuildUpgrade dtb-marvellUpgrade dtb-amlogicUpgrade reiserfs-kmp-64kbUpgrade kernel-sourceUpgrade cluster-md-kmp-azureUpgrade kernel-obs-buildUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-develUpgrade gfs2-kmp-64kbUpgrade dtb-rockchipUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmall-develUpgrade kselftests-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-devel-azureUpgrade kernel-default-develUpgrade kernel-azure-vdsoUpgrade kernel-azure-livepatch-develUpgrade kernel-rt-optionalUpgrade kernel-rt-extraUpgrade dtb-lgUpgrade dlm-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-preemptUpgrade kernel-macrosUpgrade kernel-rtUpgrade kernel-docsUpgrade dtb-qcomUpgrade dtb-freescale | Mar 13, 2024 | Feb 23, 2024 |
| Ubuntu | — | Upgrade linux-image-6.5.0-1021-nvidiaUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-102-genericUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-gkeUpgrade linux-image-6.5.0-41-lowlatencyUpgrade linux-image-5.15.0-1060-azure-fdeUpgrade linux-image-6.5.0-41-generic-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-intel-iotgUpgrade linux-image-6.5.0-1017-laptopUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-1052-intel-iotgUpgrade linux-image-5.15.0-102-generic-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-6.5.0-41-lowlatency-64kUpgrade linux-image-nvidiaUpgrade linux-image-5.15.0-1055-gcpUpgrade linux-image-6.5.0-1022-gcpUpgrade linux-image-6.5.0-1022-azureUpgrade linux-image-oem-20.04cUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-1055-oracleUpgrade linux-image-virtualUpgrade linux-image-5.15.0-1054-kvmUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oem-20.04dUpgrade linux-image-gkeop-5.15Upgrade linux-image-oem-20.04bUpgrade linux-image-genericUpgrade linux-image-gcpUpgrade linux-image-azure-lts-22.04Upgrade linux-image-oracle-64kUpgrade linux-image-5.15.0-1060-azureUpgrade linux-image-oem-20.04Upgrade linux-image-6.5.0-1022-azure-fdeUpgrade linux-image-oracleUpgrade linux-image-intelUpgrade linux-image-5.15.0-1050-raspiUpgrade linux-image-5.15.0-1054-gkeUpgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1048-nvidia-lowlatencyUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-5.15.0-102-lowlatency-64kUpgrade linux-image-oem-22.04Upgrade linux-image-5.15.0-1050-ibmUpgrade linux-image-6.5.0-41-genericUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-1057-awsUpgrade linux-image-ibmUpgrade linux-image-5.15.0-1040-gkeopUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-raspiUpgrade linux-image-gke-5.15Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-starfiveUpgrade linux-image-6.1.0-1035-oemUpgrade linux-image-6.5.0-1024-oemUpgrade linux-image-awsUpgrade linux-image-azure-fdeUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-raspi-nolpaeUpgrade linux-image-6.5.0-1024-oracle-64kUpgrade linux-image-6.5.0-1015-starfiveUpgrade linux-image-6.5.0-1021-awsUpgrade linux-image-oem-22.04dUpgrade linux-image-aws-lts-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-102-generic-lpaeUpgrade linux-image-azureUpgrade linux-image-5.15.0-102-lowlatencyUpgrade linux-image-6.5.0-1021-nvidia-64kUpgrade linux-image-5.15.0-1048-nvidiaUpgrade linux-image-oem-22.04bUpgrade linux-image-oem-22.04aUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-kvmUpgrade linux-image-nvidia-6.5Upgrade linux-image-azure-cvmUpgrade linux-image-6.5.0-1024-oracleUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-laptop-23.10Upgrade linux-image-6.5.0-1018-raspi | Mar 12, 2024 | Feb 23, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 23, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub