In the Linux kernel, the following vulnerability has been resolved:
powerpc: Avoid nmienter/nmiexit in real mode interrupt.
nmienter()/nmiexit() touches per cpu variables which can lead to kernel crash when invoked during real mode interrupt handling (e.g. early HMI/MCE interrupt handler) if percpu allocation comes from vmalloc area.
Early HMI/MCE handlers are called through DEFINEINTERRUPTHANDLERNMI() wrapper which invokes nmienter/nmiexit calls. We don't see any issue when percpu allocation is from the embedded first chunk. However with CONFIGNEEDPERCPUPAGEFIRST_CHUNK enabled there are chances where percpu allocation can come from the vmalloc area.
With kernel command line "percpualloc=page" we can force percpu allocation to come from vmalloc area and can see kernel crash in machinecheck_early:
[ 1.215714] NIP [c000000000e49eb4] rcunmienter+0x24/0x110 [ 1.215717] LR [c0000000000461a0] machinecheckearly+0xf0/0x2c0 [ 1.215719] --- interrupt: 200 [ 1.215720] [c000000fffd73180] [0000000000000000] 0x0 (unreliable) [ 1.215722] [c000000fffd731b0] [0000000000000000] 0x0 [ 1.215724] [c000000fffd73210] [c000000000008364] machinecheckearly_common+0x134/0x1f8
Fix this by avoiding use of nmienter()/nmiexit() in real mode if percpu first chunk is not embedded.
[
{
"digest": {
"line_hashes": [
"283226548042033907994230908509090561192",
"339701404700824064187385461392238838910",
"130758277746246528550678571297197789987"
],
"threshold": 0.9
},
"target": {
"file": "arch/powerpc/include/asm/percpu.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0db880fc865ffb522141ced4bfa66c12ab1fbb70",
"id": "CVE-2024-42126-01323a00",
"signature_type": "Line"
},
{
"digest": {
"length": 348.0,
"function_hash": "30527046916240262771566186428016394720"
},
"target": {
"function": "machine_check_early",
"file": "arch/powerpc/kernel/mce.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb6675db04c4b79883373edc578d5df7bbc84848",
"id": "CVE-2024-42126-2d1d8ebd",
"signature_type": "Function"
},
{
"digest": {
"length": 660.0,
"function_hash": "140405119394379248738572601127380618884"
},
"target": {
"function": "interrupt_nmi_enter_prepare",
"file": "arch/powerpc/include/asm/interrupt.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2afb26615adf6c3ceaaa7732aa839bcd587a057",
"id": "CVE-2024-42126-2d3c7ebe",
"signature_type": "Function"
},
{
"digest": {
"length": 938.0,
"function_hash": "13035511494711906699401763104381699142"
},
"target": {
"function": "setup_per_cpu_areas",
"file": "arch/powerpc/kernel/setup_64.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb6675db04c4b79883373edc578d5df7bbc84848",
"id": "CVE-2024-42126-43c4f080",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"92929517206655701031288626818568718010",
"62495122501143293697846140483345850171",
"269336369216926455634657672911744754902",
"40207646021846505516127138818997086663",
"230649652576479246684962489025294884441",
"256356438152151031917168970555444772510"
],
"threshold": 0.9
},
"target": {
"file": "arch/powerpc/include/asm/interrupt.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8d3f83dfb23674540c827a8d65fba20aa300b252",
"id": "CVE-2024-42126-5d3ce08b",
"signature_type": "Line"
},
{
"digest": {
"length": 681.0,
"function_hash": "309495070352079431627527187480937203334"
},
"target": {
"function": "interrupt_nmi_exit_prepare",
"file": "arch/powerpc/include/asm/interrupt.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2afb26615adf6c3ceaaa7732aa839bcd587a057",
"id": "CVE-2024-42126-7028f862",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"78741837770440734533207522005618009920",
"81084700089068279568965525679297628753",
"102275388760461025337459254804325928559",
"307168545376077358150205051299827038485",
"15689163329226797572478829679531702282",
"309230084715985390205480404260173330251",
"308491665491262658133965857391643621866"
],
"threshold": 0.9
},
"target": {
"file": "arch/powerpc/kernel/setup_64.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb6675db04c4b79883373edc578d5df7bbc84848",
"id": "CVE-2024-42126-7043d508",
"signature_type": "Line"
},
{
"digest": {
"length": 758.0,
"function_hash": "190908897175934405286181203175669288075"
},
"target": {
"function": "interrupt_nmi_exit_prepare",
"file": "arch/powerpc/include/asm/interrupt.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8d3f83dfb23674540c827a8d65fba20aa300b252",
"id": "CVE-2024-42126-75703419",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"92929517206655701031288626818568718010",
"62495122501143293697846140483345850171",
"269336369216926455634657672911744754902",
"40207646021846505516127138818997086663",
"230649652576479246684962489025294884441",
"256356438152151031917168970555444772510"
],
"threshold": 0.9
},
"target": {
"file": "arch/powerpc/include/asm/interrupt.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0db880fc865ffb522141ced4bfa66c12ab1fbb70",
"id": "CVE-2024-42126-78bbf148",
"signature_type": "Line"
},
{
"digest": {
"length": 938.0,
"function_hash": "13035511494711906699401763104381699142"
},
"target": {
"function": "setup_per_cpu_areas",
"file": "arch/powerpc/kernel/setup_64.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2afb26615adf6c3ceaaa7732aa839bcd587a057",
"id": "CVE-2024-42126-7c9d8c77",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"284276043210192368131361743655691648608",
"128876123576270769348994088942162812589",
"335425840084426230178073140316316148726",
"251283019897157688010119487903132361985",
"103954423696481019192027840335009549646",
"309230084715985390205480404260173330251",
"308491665491262658133965857391643621866"
],
"threshold": 0.9
},
"target": {
"file": "arch/powerpc/kernel/setup_64.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8d3f83dfb23674540c827a8d65fba20aa300b252",
"id": "CVE-2024-42126-870b1a37",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"321425791573948204120985181013116083733",
"191956572674471932151361562964041483440",
"198301437986979455880742314088254594559",
"157501679385274500777381697432287736693",
"166210211220012117880281221610218689844",
"280564068559318766289103926360951440386",
"238128020800814286345364162476710429887",
"42482787577066996251585433156515019418"
],
"threshold": 0.9
},
"target": {
"file": "arch/powerpc/kernel/mce.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb6675db04c4b79883373edc578d5df7bbc84848",
"id": "CVE-2024-42126-99b6fc2f",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"78741837770440734533207522005618009920",
"81084700089068279568965525679297628753",
"102275388760461025337459254804325928559",
"307168545376077358150205051299827038485",
"15689163329226797572478829679531702282",
"309230084715985390205480404260173330251",
"308491665491262658133965857391643621866"
],
"threshold": 0.9
},
"target": {
"file": "arch/powerpc/kernel/setup_64.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2afb26615adf6c3ceaaa7732aa839bcd587a057",
"id": "CVE-2024-42126-9dbce694",
"signature_type": "Line"
},
{
"digest": {
"length": 758.0,
"function_hash": "190908897175934405286181203175669288075"
},
"target": {
"function": "interrupt_nmi_exit_prepare",
"file": "arch/powerpc/include/asm/interrupt.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0db880fc865ffb522141ced4bfa66c12ab1fbb70",
"id": "CVE-2024-42126-a1db706d",
"signature_type": "Function"
},
{
"digest": {
"length": 1031.0,
"function_hash": "174171492620882688462015802967844930058"
},
"target": {
"function": "setup_per_cpu_areas",
"file": "arch/powerpc/kernel/setup_64.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0db880fc865ffb522141ced4bfa66c12ab1fbb70",
"id": "CVE-2024-42126-b33d51af",
"signature_type": "Function"
},
{
"digest": {
"length": 702.0,
"function_hash": "295540782637281963626708828575098455474"
},
"target": {
"function": "machine_check_exception",
"file": "arch/powerpc/kernel/traps.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb6675db04c4b79883373edc578d5df7bbc84848",
"id": "CVE-2024-42126-b6ce8809",
"signature_type": "Function"
},
{
"digest": {
"length": 752.0,
"function_hash": "13747998791294241558853538603346146516"
},
"target": {
"function": "interrupt_nmi_enter_prepare",
"file": "arch/powerpc/include/asm/interrupt.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8d3f83dfb23674540c827a8d65fba20aa300b252",
"id": "CVE-2024-42126-b8281520",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"283226548042033907994230908509090561192",
"339701404700824064187385461392238838910",
"130758277746246528550678571297197789987"
],
"threshold": 0.9
},
"target": {
"file": "arch/powerpc/include/asm/percpu.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2afb26615adf6c3ceaaa7732aa839bcd587a057",
"id": "CVE-2024-42126-c110e5f8",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"208902917039967884987495739926738451939",
"31808569556697387333366267006400309097",
"45737829591087695471265600830933245028",
"195690227529105394155419136920763700837"
],
"threshold": 0.9
},
"target": {
"file": "arch/powerpc/kernel/traps.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb6675db04c4b79883373edc578d5df7bbc84848",
"id": "CVE-2024-42126-c981e27b",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"283226548042033907994230908509090561192",
"339701404700824064187385461392238838910",
"130758277746246528550678571297197789987"
],
"threshold": 0.9
},
"target": {
"file": "arch/powerpc/include/asm/percpu.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb6675db04c4b79883373edc578d5df7bbc84848",
"id": "CVE-2024-42126-d4b60bc2",
"signature_type": "Line"
},
{
"digest": {
"length": 1031.0,
"function_hash": "174171492620882688462015802967844930058"
},
"target": {
"function": "setup_per_cpu_areas",
"file": "arch/powerpc/kernel/setup_64.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8d3f83dfb23674540c827a8d65fba20aa300b252",
"id": "CVE-2024-42126-eb7c254a",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"283226548042033907994230908509090561192",
"339701404700824064187385461392238838910",
"130758277746246528550678571297197789987"
],
"threshold": 0.9
},
"target": {
"file": "arch/powerpc/include/asm/percpu.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8d3f83dfb23674540c827a8d65fba20aa300b252",
"id": "CVE-2024-42126-f02bc0fc",
"signature_type": "Line"
},
{
"digest": {
"length": 752.0,
"function_hash": "13747998791294241558853538603346146516"
},
"target": {
"function": "interrupt_nmi_enter_prepare",
"file": "arch/powerpc/include/asm/interrupt.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0db880fc865ffb522141ced4bfa66c12ab1fbb70",
"id": "CVE-2024-42126-f3857759",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"284276043210192368131361743655691648608",
"128876123576270769348994088942162812589",
"335425840084426230178073140316316148726",
"251283019897157688010119487903132361985",
"103954423696481019192027840335009549646",
"309230084715985390205480404260173330251",
"308491665491262658133965857391643621866"
],
"threshold": 0.9
},
"target": {
"file": "arch/powerpc/kernel/setup_64.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0db880fc865ffb522141ced4bfa66c12ab1fbb70",
"id": "CVE-2024-42126-f474ae16",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"10901439570887839875576271274056059618",
"190655957457343854172488589681606204641",
"203834050995994998367010358559625726592",
"258818918908243045868802304801910967032",
"261712275644340409572021698601427016508",
"222587568356247345058000766354377883822",
"236412087760981041578098456004499539552",
"274683343043268430735331936741577479195",
"130787039052222757422558391099863583551",
"307524384378105668778321873529742201179",
"24258258637572643338042414772096939834",
"98005877012063617325444688872257086414",
"235651452650884229119342739066751746000"
],
"threshold": 0.9
},
"target": {
"file": "arch/powerpc/include/asm/interrupt.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2afb26615adf6c3ceaaa7732aa839bcd587a057",
"id": "CVE-2024-42126-fbf650d5",
"signature_type": "Line"
}
]