CVE-2024-26603

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26603
In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Stop relying on userspace for info to fault in xsave buffer Before this change, the expected size of the user space buffer was taken from fx_sw->xstate_size. fx_sw->xstate_size can be changed from user-space, so it is possible construct a sigreturn frame where: * fx_sw->xstate_size is smaller than the size required by valid bits in fx_sw->xfeatures. * user-space unmaps parts of the sigrame fpu buffer so that not all of the buffer required by xrstor is accessible. In this case, xrstor tries to restore and accesses the unmapped area which results in a fault. But fault_in_readable succeeds because buf + fx_sw->xstate_size is within the still mapped area, so it goes back and tries xrstor again. It will spin in this loop forever. Instead, fault in the maximum size which can be touched by XRSTOR (taken from fpstate->user_size). [ dhansen: tweak subject / changelog ]

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/627339cccdc9166792ecf96bc3c9f711a60ce996 Patch
https://git.kernel.org/stable/c/627e28cbb65564e55008315d9e02fbb90478beda Patch
https://git.kernel.org/stable/c/8bd3eee7720c14b59a206bd05b98d7586bccf99a Patch
https://git.kernel.org/stable/c/b2479ab426cef7ab79a13005650eff956223ced2 Patch
https://git.kernel.org/stable/c/d877550eaf2dc9090d782864c96939397a3c6835 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

17 Apr 2024, 18:00

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-835
References () https://git.kernel.org/stable/c/627339cccdc9166792ecf96bc3c9f711a60ce996 - () https://git.kernel.org/stable/c/627339cccdc9166792ecf96bc3c9f711a60ce996 - Patch
References () https://git.kernel.org/stable/c/627e28cbb65564e55008315d9e02fbb90478beda - () https://git.kernel.org/stable/c/627e28cbb65564e55008315d9e02fbb90478beda - Patch
References () https://git.kernel.org/stable/c/8bd3eee7720c14b59a206bd05b98d7586bccf99a - () https://git.kernel.org/stable/c/8bd3eee7720c14b59a206bd05b98d7586bccf99a - Patch
References () https://git.kernel.org/stable/c/b2479ab426cef7ab79a13005650eff956223ced2 - () https://git.kernel.org/stable/c/b2479ab426cef7ab79a13005650eff956223ced2 - Patch
References () https://git.kernel.org/stable/c/d877550eaf2dc9090d782864c96939397a3c6835 - () https://git.kernel.org/stable/c/d877550eaf2dc9090d782864c96939397a3c6835 - Patch

01 Mar 2024, 14:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM/', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OX4EWCYDZRTOEMC2C6OF7ZACAP23SUB5/', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}
  • () https://git.kernel.org/stable/c/8bd3eee7720c14b59a206bd05b98d7586bccf99a -

28 Feb 2024, 03:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: x86/fpu: dejar de depender del espacio de usuario para que la información falle en el búfer xsave Antes de este cambio, el tamaño esperado del búfer de espacio de usuario se tomaba de fx_sw->xstate_size. fx_sw->xstate_size se puede cambiar desde el espacio de usuario, por lo que es posible construir un marco sigreturn donde: * fx_sw->xstate_size es más pequeño que el tamaño requerido por los bits válidos en fx_sw->xfeatures. * el espacio de usuario desasigna partes del búfer fpu de sigrame para que no se pueda acceder a todo el búfer requerido por xrstor. En este caso, xrstor intenta restaurar y accede al área no asignada, lo que genera una falla. Pero falla_in_readable tiene éxito porque buf + fx_sw->xstate_size está dentro del área aún mapeada, por lo que regresa e intenta xrstor nuevamente. Girará en este bucle para siempre. En cambio, falla en el tamaño máximo que XRSTOR puede tocar (tomado de fpstate->user_size). [dhansen: modificar asunto/registro de cambios]
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OX4EWCYDZRTOEMC2C6OF7ZACAP23SUB5/ -

26 Feb 2024, 16:32

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-26 16:28

Updated : 2024-04-17 18:00

NVD link : CVE-2024-26603

Mitre link : CVE-2024-26603

CVE.ORG link : CVE-2024-26603

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')