In the Linux kernel, the following vulnerability has been resolved:
efivarfs: force RO when remounting if SetVariable is not supported
If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a crash looking like this:
$ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK
[ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04: level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr : efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [ 303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [ 303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [ 303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code: ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]---
Fix this by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and deny anything that's not RO if the firmware doesn't implement SetVariable at runtime.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-kvmUpgrade kernel-rt-debug-develUpgrade kernel-rt-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-uki-virtUpgrade kernel-64k-debug-develUpgrade kernel-64k-develUpgrade kernel-debug-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debugUpgrade kernel-debug-develUpgrade kernel-rt-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-develUpgrade kernel-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-uki-virtUpgrade kernel-modules-extraUpgrade kernel-64k-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-modules-coreUpgrade kernel-rt-develUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-develUpgrade kernel-64k-modulesUpgrade kernel-64kUpgrade kernel-coreUpgrade kernel-64k-coreUpgrade rtlaUpgrade kernel-debug-modules-coreUpgrade kernel-debugUpgrade kernel-debug-modulesUpgrade kernel-tools-libsUpgrade bpftoolUpgrade libperfUpgrade kernel-toolsUpgrade kernel-cross-headersUpgrade kernel-64k-debugUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-debug-modules-extraUpgrade perfUpgrade kernel-headersUpgrade rvUpgrade kernel-64k-devel-matchedUpgrade kernel-docUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-rt-modules-extraUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-debug-coreUpgrade kernelUpgrade kernel-tools-libs-develUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-modules-extraUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rtUpgrade kernel-64k-debug-devel-matched | Aug 12, 2024 | Feb 23, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-tools-develUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.209-198.812Upgrade perfUpgrade bpftoolUpgrade python-perfUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-livepatch-5.15.148-97.158 | Mar 19, 2024 | Feb 23, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-develUpgrade python3-perf-debuginfoUpgrade kernel-livepatch-6.1.75-99.163Upgrade kernel-libbpf-develUpgrade python3-perfUpgrade kernel-libbpf-staticUpgrade kernel-develUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extra-commonUpgrade kernel-modules-extraUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-libbpfUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-headers | Feb 17, 2025 | Feb 23, 2024 |
| Debian | — | Upgrade linux | Jun 27, 2024 | Feb 23, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernelUpgrade kernel-tools-libs | Jun 3, 2024 | Feb 23, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade python3-perfUpgrade kernel | Jul 1, 2024 | Feb 23, 2024 |
| Oracle_linux | — | Upgrade kernel | Aug 16, 2024 | Feb 23, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Aug 12, 2024 | Feb 23, 2024 |
| Rocky_linux | — | Upgrade libperf-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-kvmUpgrade bpftool-debuginfoUpgrade kernel-cross-headersUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debug-modulesUpgrade kernel-rt-debug-debuginfoUpgrade libperfUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-coreUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-develUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libsUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-modulesUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-devel-matchedUpgrade kernel-rt-debug-coreUpgrade kernel-rtUpgrade kernelUpgrade kernel-devel-matchedUpgrade kernel-rt-debuginfoUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade rtlaUpgrade kernel-debug-uki-virtUpgrade kernel-debuginfoUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-develUpgrade kernel-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debugUpgrade kernel-debugUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-uki-virtUpgrade kernel-rt-coreUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-develUpgrade python3-perf-debuginfoUpgrade rvUpgrade kernel-modules-extraUpgrade kernel-debug-develUpgrade python3-perfUpgrade perf-debuginfoUpgrade perfUpgrade kernel-rt-kvmUpgrade kernel-rt-modulesUpgrade kernel-toolsUpgrade bpftool | Aug 22, 2024 | Feb 23, 2024 |
| Suse | — | Upgrade dlm-kmp-azureUpgrade kernel-default-develUpgrade kernel-devel-azureUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-64kbUpgrade dtb-marvellUpgrade kernel-source-azureUpgrade dtb-freescaleUpgrade kernel-zfcpdumpUpgrade dtb-qcomUpgrade dtb-rockchipUpgrade kernel-default-base-rebuildUpgrade kernel-rt_debugUpgrade dtb-amlogicUpgrade kernel-docsUpgrade kernel-syms-rtUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-64kbUpgrade cluster-md-kmp-defaultUpgrade dtb-apmUpgrade kernel-rtUpgrade kernel-default-extraUpgrade ocfs2-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-obs-buildUpgrade dtb-broadcomUpgrade kernel-64kb-livepatch-develUpgrade kernel-obs-qaUpgrade dlm-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade kernel-kvmsmallUpgrade dtb-amazonUpgrade kernel-sourceUpgrade kernel-rt-extraUpgrade kernel-rt-optionalUpgrade kernel-preemptUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-defaultUpgrade dtb-lgUpgrade kernel-macrosUpgrade dtb-armUpgrade dtb-socionextUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-docs-htmlUpgrade kernel-source-rtUpgrade kernel-debug-livepatch-develUpgrade kernel-syms-azureUpgrade kernel-azure-develUpgrade dtb-exynosUpgrade kernel-kvmsmall-vdsoUpgrade gfs2-kmp-64kbUpgrade gfs2-kmp-rtUpgrade kernel-64kb-optionalUpgrade dtb-xilinxUpgrade kernel-kvmsmall-livepatch-develUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-source-vanillaUpgrade kernel-azure-optionalUpgrade dtb-nvidiaUpgrade dlm-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-appleUpgrade kselftests-kmp-rtUpgrade dtb-sprdUpgrade kernel-rt-livepatchUpgrade kernel-devel-rtUpgrade kernel-default-optionalUpgrade kernel-develUpgrade dtb-hisiliconUpgrade kernel-default-livepatch-develUpgrade kernel-rt_debug-develUpgrade cluster-md-kmp-rtUpgrade dlm-kmp-rtUpgrade dtb-mediatekUpgrade kernel-rt-develUpgrade kernel-default-livepatchUpgrade kernel-azure-extraUpgrade dtb-renesasUpgrade reiserfs-kmp-rtUpgrade dtb-caviumUpgrade kernel-debug-develUpgrade kernel-azureUpgrade gfs2-kmp-defaultUpgrade kernel-symsUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-azureUpgrade gfs2-kmp-azureUpgrade dtb-amdUpgrade cluster-md-kmp-64kbUpgrade dtb-allwinnerUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-debug-vdsoUpgrade dtb-alteraUpgrade kernel-defaultUpgrade kernel-debugUpgrade kernel-preempt-develUpgrade kernel-64kb-extra | Mar 13, 2024 | Feb 23, 2024 |
| Ubuntu | — | Upgrade linux-image-6.5.0-1022-azureUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-oracle-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-5.15.0-102-lowlatency-64kUpgrade linux-image-5.15.0-1060-azureUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-5.15.0-1050-raspiUpgrade linux-image-genericUpgrade linux-image-generic-64kUpgrade linux-image-gkeUpgrade linux-image-5.15.0-1050-ibmUpgrade linux-image-oem-22.04cUpgrade linux-image-oem-20.04cUpgrade linux-image-nvidiaUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-20.04Upgrade linux-image-6.5.0-1022-gcpUpgrade linux-image-oem-20.04bUpgrade linux-image-gkeop-5.15Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-1048-nvidia-lowlatencyUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1054-gkeUpgrade linux-image-5.15.0-1055-oracleUpgrade linux-image-5.15.0-1055-gcpUpgrade linux-image-virtualUpgrade linux-image-6.5.0-1022-azure-fdeUpgrade linux-image-azure-lts-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-intelUpgrade linux-image-oracleUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-5.15.0-102-genericUpgrade linux-image-6.5.0-41-lowlatencyUpgrade linux-image-5.15.0-1052-intel-iotgUpgrade linux-image-gcpUpgrade linux-image-6.5.0-1017-laptopUpgrade linux-image-6.5.0-1021-nvidiaUpgrade linux-image-5.15.0-102-generic-64kUpgrade linux-image-oem-22.04Upgrade linux-image-gkeopUpgrade linux-image-6.5.0-41-generic-64kUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.5.0-41-lowlatency-64kUpgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-1054-kvmUpgrade linux-image-5.15.0-1060-azure-fdeUpgrade linux-image-lowlatency-64kUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-102-lowlatencyUpgrade linux-image-aws-lts-22.04Upgrade linux-image-azureUpgrade linux-image-starfiveUpgrade linux-image-oem-22.04bUpgrade linux-image-5.15.0-1048-nvidiaUpgrade linux-image-6.5.0-1024-oracleUpgrade linux-image-azure-cvmUpgrade linux-image-laptop-23.10Upgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-64k-6.5Upgrade linux-image-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-6.5.0-1015-starfiveUpgrade linux-image-nvidia-6.5Upgrade linux-image-azure-fdeUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.5.0-1021-awsUpgrade linux-image-5.15.0-1040-gkeopUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-6.5.0-1024-oracle-64kUpgrade linux-image-5.15.0-102-generic-lpaeUpgrade linux-image-5.15.0-1057-awsUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.5.0-1018-raspiUpgrade linux-image-6.5.0-41-genericUpgrade linux-image-6.1.0-1035-oemUpgrade linux-image-gke-5.15Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-awsUpgrade linux-image-kvmUpgrade linux-image-6.5.0-1021-nvidia-64kUpgrade linux-image-raspiUpgrade linux-image-6.5.0-1024-oemUpgrade linux-image-raspi-nolpaeUpgrade linux-image-oem-22.04dUpgrade linux-image-generic-hwe-20.04 | Mar 12, 2024 | Feb 23, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 23, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub