CVE-2024-50194

In the Linux kernel, the following vulnerability has been resolved:

arm64: probes: Fix uprobes for big-endian kernels

The arm64 uprobes code is broken for big-endian kernels as it doesn't convert the in-memory instruction encoding (which is always little-endian) into the kernel's native endianness before analyzing and simulating instructions. This may result in a few distinct problems:

• The kernel may may erroneously reject probing an instruction which can safely be probed.

• The kernel may erroneously erroneously permit stepping an instruction out-of-line when that instruction cannot be stepped out-of-line safely.

• The kernel may erroneously simulate instruction incorrectly dur to interpretting the byte-swapped encoding.

The endianness mismatch isn't caught by the compiler or sparse because:

• The arch_uprobe::{insn,ixol} fields are encoded as arrays of u8, so the compiler and sparse have no idea these contain a little-endian 32-bit value. The core uprobes code populates these with a memcpy() which similarly does not handle endianness.

• While the uprobeopcodet type is an alias for _le32, both archuprobeanalyzeinsn() and archuprobeskipsstep() cast from u8[] to the similarly-named probeopcode_t, which is an alias for u32. Hence there is no endianness conversion warning.

Fix this by changing the archuprobe::{insn,ixol} fields to _le32 and adding the appropriate _le32to_cpu() conversions prior to consuming the instruction encoding. The core uprobes copies these fields as opaque ranges of bytes, and so is unaffected by this change.

At the same time, remove MAXUINSNBYTES and consistently use AARCH64INSNSIZE for clarity.

Tested with the following:

| #include <stdio.h> | #include <stdbool.h> | | #define noinline attribute((noinline)) | | static noinline void *adrpself(void) | { | void *addr; | | asm volatile( | " adrp %x0, adrpself\n" | " add %x0, %x0, :lo12:adrpself\n" | : "=r" (addr)); | } | | | int main(int argc, char *argv) | { | void *ptr = adrpself(); | bool equal = (ptr == adrpself); | | printf("adrpself => %p\n" | "adrpself() => %p\n" | "%s\n", | adrpself, ptr, equal ? "EQUAL" : "NOT EQUAL"); | | return 0; | }

.... where the adrp_self() function was compiled to:

| 00000000004007e0 <adrp_self>: | 4007e0: 90000000 adrp x0, 400000 <__ehdr_start> | 4007e4: 911f8000 add x0, x0, #0x7e0 | 4007e8: d65f03c0 ret

Before this patch, the ADRP is not recognized, and is assumed to be steppable, resulting in corruption of the result:

| # ./adrp-self | adrpself => 0x4007e0 | adrpself() => 0x4007e0 | EQUAL | # echo 'p /root/adrp-self:0x007e0' > /sys/kernel/tracing/uprobeevents | # echo 1 > /sys/kernel/tracing/events/uprobes/enable | # ./adrp-self | adrpself => 0x4007e0 | adrp_self() => 0xffffffffff7e0 | NOT EQUAL

After this patch, the ADRP is correctly recognized and simulated:

| # ./adrp-self | adrpself => 0x4007e0 | adrpself() => 0x4007e0 | EQUAL | # | # echo 'p /root/adrp-self:0x007e0' > /sys/kernel/tracing/uprobeevents | # echo 1 > /sys/kernel/tracing/events/uprobes/enable | # ./adrp-self | adrpself => 0x4007e0 | adrp_self() => 0x4007e0 | EQUAL