CVE-2022-49440
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-49440
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49440.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-49440
- Downstream
- Related
- Published
- 2025-02-26T02:12:53Z
- Modified
- 2025-10-21T10:39:50.134489Z
- Summary
- powerpc/rtas: Keep MSR[RI] set when calling RTAS
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
powerpc/rtas: Keep MSR[RI] set when calling RTAS
RTAS runs in real mode (MSR[DR] and MSR[IR] unset) and in 32-bit big endian mode (MSR[SF,LE] unset).
The change in MSR is done in enter_rtas() in a relatively complex way, since the MSR value could be hardcoded.
Furthermore, a panic has been reported when hitting the watchdog interrupt while running in RTAS, this leads to the following stack trace:
watchdog: CPU 24 Hard LOCKUP watchdog: CPU 24 TB:997512652051031, last heartbeat TB:997504470175378 (15980ms ago) ... Supported: No, Unreleased kernel CPU: 24 PID: 87504 Comm: drmgr Kdump: loaded Tainted: G E X 5.14.21-150400.71.1.bz1963622-default #1 SLE15-SP4 (unreleased) 0d821077ef4faa8dfaf370efb5fdca1fa35f4e2c NIP: 000000001fb41050 LR: 000000001fb4104c CTR: 0000000000000000 REGS: c00000000fc33d60 TRAP: 0100 Tainted: G E X (5.14.21-150400.71.1.bz1963622-default) MSR: 8000000002981000 <SF,VEC,VSX,ME> CR: 48800002 XER: 20040020 CFAR: 000000000000011c IRQMASK: 1 GPR00: 0000000000000003 ffffffffffffffff 0000000000000001 00000000000050dc GPR04: 000000001ffb6100 0000000000000020 0000000000000001 000000001fb09010 GPR08: 0000000020000000 0000000000000000 0000000000000000 0000000000000000 GPR12: 80040000072a40a8 c00000000ff8b680 0000000000000007 0000000000000034 GPR16: 000000001fbf6e94 000000001fbf6d84 000000001fbd1db0 000000001fb3f008 GPR20: 000000001fb41018 ffffffffffffffff 000000000000017f fffffffffffff68f GPR24: 000000001fb18fe8 000000001fb3e000 000000001fb1adc0 000000001fb1cf40 GPR28: 000000001fb26000 000000001fb460f0 000000001fb17f18 000000001fb17000 NIP [000000001fb41050] 0x1fb41050 LR [000000001fb4104c] 0x1fb4104c Call Trace: Instruction dump: XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX Oops: Unrecoverable System Reset, sig: 6 [#1] LE PAGESIZE=64K MMU=Hash SMP NRCPUS=2048 NUMA pSeries ... Supported: No, Unreleased kernel CPU: 24 PID: 87504 Comm: drmgr Kdump: loaded Tainted: G E X 5.14.21-150400.71.1.bz1963622-default #1 SLE15-SP4 (unreleased) 0d821077ef4faa8dfaf370efb5fdca1fa35f4e2c NIP: 000000001fb41050 LR: 000000001fb4104c CTR: 0000000000000000 REGS: c00000000fc33d60 TRAP: 0100 Tainted: G E X (5.14.21-150400.71.1.bz1963622-default) MSR: 8000000002981000 <SF,VEC,VSX,ME> CR: 48800002 XER: 20040020 CFAR: 000000000000011c IRQMASK: 1 GPR00: 0000000000000003 ffffffffffffffff 0000000000000001 00000000000050dc GPR04: 000000001ffb6100 0000000000000020 0000000000000001 000000001fb09010 GPR08: 0000000020000000 0000000000000000 0000000000000000 0000000000000000 GPR12: 80040000072a40a8 c00000000ff8b680 0000000000000007 0000000000000034 GPR16: 000000001fbf6e94 000000001fbf6d84 000000001fbd1db0 000000001fb3f008 GPR20: 000000001fb41018 ffffffffffffffff 000000000000017f fffffffffffff68f GPR24: 000000001fb18fe8 000000001fb3e000 000000001fb1adc0 000000001fb1cf40 GPR28: 000000001fb26000 000000001fb460f0 000000001fb17f18 000000001fb17000 NIP [000000001fb41050] 0x1fb41050 LR [000000001fb4104c] 0x1fb4104c Call Trace: Instruction dump: XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX ---[ end trace 3ddec07f638c34a2 ]---
This happens because MSR[RI] is unset when entering RTAS but there is no valid reason to not set it here.
RTAS is expected to be called with MSR[RI] as specified in PAPR+ section "7.2.1 Machine State":
R1–7.2.1–9. If called with MSR[RI] equal to 1, then RTAS must protect its own critical regions from recursion by setting the MSR[RI] bit to 0 when in the critical regions.
Fixing this by reviewing the way MSR is compute before calling RTAS. Now a hardcoded value meaning real ---truncated---
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/5ca40fcf0da0ce2b5bc44e7d8b036535955f2e3d
- https://git.kernel.org/stable/c/5f4367448f6817c8a0e94dc9736ed84fa8eee4a3
- https://git.kernel.org/stable/c/b6b1c3ce06ca438eb24e0f45bf0e63ecad0369f5
- https://git.kernel.org/stable/c/c9c41f0273826a13ac93124e66a4ff45df281ba0
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1da177e4c3f41524e886b7f1b8a0c1fc7321cac2Fixed5ca40fcf0da0ce2b5bc44e7d8b036535955f2e3d
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1da177e4c3f41524e886b7f1b8a0c1fc7321cac2Fixed5f4367448f6817c8a0e94dc9736ed84fa8eee4a3
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1da177e4c3f41524e886b7f1b8a0c1fc7321cac2Fixedc9c41f0273826a13ac93124e66a4ff45df281ba0
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1da177e4c3f41524e886b7f1b8a0c1fc7321cac2Fixedb6b1c3ce06ca438eb24e0f45bf0e63ecad0369f5
Affected versions
v2.*
v3.*
v4.*
v5.*
Database specific
vanir_signatures
[
{
"signature_type": "Function",
"digest": {
"function_hash": "227015393522892825210067607809460544187",
"length": 93.0
},
"target": {
"file": "arch/powerpc/kernel/rtas.c",
"function": "do_enter_rtas"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ca40fcf0da0ce2b5bc44e7d8b036535955f2e3d",
"id": "CVE-2022-49440-02e271f3",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"284475892850840933150228265378116705705",
"234170544957895501243602240858197382689",
"102112773235185020176865968103355843320",
"179976676960957122858111905841430661492"
]
},
"target": {
"file": "arch/powerpc/kernel/rtas.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6b1c3ce06ca438eb24e0f45bf0e63ecad0369f5",
"id": "CVE-2022-49440-309c1608",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "227015393522892825210067607809460544187",
"length": 93.0
},
"target": {
"file": "arch/powerpc/kernel/rtas.c",
"function": "do_enter_rtas"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c9c41f0273826a13ac93124e66a4ff45df281ba0",
"id": "CVE-2022-49440-53fc7e9a",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "227015393522892825210067607809460544187",
"length": 93.0
},
"target": {
"file": "arch/powerpc/kernel/rtas.c",
"function": "do_enter_rtas"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f4367448f6817c8a0e94dc9736ed84fa8eee4a3",
"id": "CVE-2022-49440-74c5b776",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"284475892850840933150228265378116705705",
"234170544957895501243602240858197382689",
"102112773235185020176865968103355843320",
"179976676960957122858111905841430661492"
]
},
"target": {
"file": "arch/powerpc/kernel/rtas.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f4367448f6817c8a0e94dc9736ed84fa8eee4a3",
"id": "CVE-2022-49440-92323d46",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"284475892850840933150228265378116705705",
"234170544957895501243602240858197382689",
"102112773235185020176865968103355843320",
"179976676960957122858111905841430661492"
]
},
"target": {
"file": "arch/powerpc/kernel/rtas.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ca40fcf0da0ce2b5bc44e7d8b036535955f2e3d",
"id": "CVE-2022-49440-9e72bdc7",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"284475892850840933150228265378116705705",
"234170544957895501243602240858197382689",
"102112773235185020176865968103355843320",
"179976676960957122858111905841430661492"
]
},
"target": {
"file": "arch/powerpc/kernel/rtas.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c9c41f0273826a13ac93124e66a4ff45df281ba0",
"id": "CVE-2022-49440-ecadac3d",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "227015393522892825210067607809460544187",
"length": 93.0
},
"target": {
"file": "arch/powerpc/kernel/rtas.c",
"function": "do_enter_rtas"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b6b1c3ce06ca438eb24e0f45bf0e63ecad0369f5",
"id": "CVE-2022-49440-f3a869a7",
"deprecated": false,
"signature_version": "v1"
}
]