CVE-2021-46997: In the Linux kernel, the following vulnerability has been resolved: arm64: entry: always set GIC_PRIO_PSR_I_SET during entry Zenghui reports that booting a…

PriorityP421medium5.5CVSS 3.1

AVLACLPRLUINSUCNINAH

EPSS

0.25%

16.0th percentile

In the Linux kernel, the following vulnerability has been resolved: arm64: entry: always set GIC_PRIO_PSR_I_SET during entry Zenghui reports that booting a kernel with "irqchip.gicv3_pseudo_nmi=1" on the command line hits a warning during kernel entry, due to the way we manipulate the PMR. Early in the entry sequence, we call lockdep_hardirqs_off() to inform lockdep that interrupts have been masked (as the HW sets DAIF wqhen entering an exception). Architecturally PMR_EL1 is not affected by exception entry, and we don't set GIC_PRIO_PSR_I_SET in the PMR early in the exception entry sequence, so early in exception entry the PMR can indicate that interrupts are unmasked even though they are masked by DAIF. If DEBUG_LOCKDEP is selected, lockdep_hardirqs_off() will check that interrupts are masked, before we set GIC_PRIO_PSR_I_SET in any of the exception entry paths, and hence lockdep_hardirqs_off() will WARN() that something is amiss. We can avoid this by consistently setting GIC_PRIO_PSR_I_SET during exception entry so that kernel code sees a consistent environment. We must also update local_daif_inherit() to undo this, as currently only touches DAIF. For other paths, local_daif_restore() will update both DAIF and the PMR. With this done, we can remove the existing special cases which set this later in the entry code. We always use (GIC_PRIO_IRQON | GIC_PRIO_PSR_I_SET) for consistency with local_daif_save(), as this will warn if it ever encounters (GIC_PRIO_IRQOFF | GIC_PRIO_PSR_I_SET), and never sets this itself. This matches the gic_prio_kentry_setup that we have to retain for ret_to_user. The original splat from Zenghui's report was: | DEBUG_LOCKS_WARN_ON(!irqs_disabled()) | WARNING: CPU: 3 PID: 125 at kernel/locking/lockdep.c:4258 lockdep_hardirqs_off+0xd4/0xe8 | Modules linked in: | CPU: 3 PID: 125 Comm: modprobe Tainted: G W 5.12.0-rc8+ #463 | Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 | pstate: 604003c5 (nZCv DAIF +PAN -UAO -TCO BTYP

Affected

13 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.10.38-1 (bookworm)	linux 5.10.38-1 (bookworm)
linux	linux	—	—
linux	linux	>= 23529049c68423820487304f244144e0d576e85a < 51524fa8b5f7b879ba569227738375d283b79382	51524fa8b5f7b879ba569227738375d283b79382
linux	linux	>= 23529049c68423820487304f244144e0d576e85a < e67a83f078005461b59b4c776e6b5addd11725fa	e67a83f078005461b59b4c776e6b5addd11725fa
linux	linux	>= 23529049c68423820487304f244144e0d576e85a < d8d52005f57bbb4a4ec02f647e2555d327135c68	d8d52005f57bbb4a4ec02f647e2555d327135c68
linux	linux	>= 23529049c68423820487304f244144e0d576e85a < 4d6a38da8e79e94cbd1344aa90876f0f805db705	4d6a38da8e79e94cbd1344aa90876f0f805db705
linux	linux_kernel	>= 0 < 5.10.38-1	5.10.38-1
linux	linux_kernel	>= 0 < 5.10.38-1	5.10.38-1
linux	linux_kernel	>= 0 < 5.10.38-1	5.10.38-1
linux	linux_kernel	>= 0 < 5.10.38-1	5.10.38-1
linux	linux_kernel	>= 5.10 < 5.10.38	5.10.38
linux	linux_kernel	>= 5.11 < 5.11.22	5.11.22
linux	linux_kernel	>= 5.12 < 5.12.5	5.12.5

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv5.5MEDIUM

vendor_debian5.5MEDIUM

vendor_redhat5.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.