CVE-2021-47465

published 2024-05-22

CVE-2021-47465: In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest() In commit 10d91611f426…

Priority P4 22 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()

In commit 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in
C") kvm_start_guest() became idle_kvm_start_guest(). The old code
allocated a stack frame on the emergency stack, but didn't use the
frame to store anything, and also didn't store anything in its caller's
frame.

idle_kvm_start_guest() on the other hand is written more like a normal C
function, it creates a frame on entry, and also stores CR/LR into its
callers frame (per the ABI). The problem is that there is no caller
frame on the emergency stack.

The emergency stack for a given CPU is allocated with:

paca_ptrs[i]->emergency_sp = alloc_stack(limit, i) + THREAD_SIZE;

So emergency_sp actually points to the first address above the emergency
stack allocation for a given CPU, we must not store above it without
first decrementing it to create a frame. This is different to the
regular kernel stack, paca->kstack, which is initialised to point at an
initial frame that is ready to use.

idle_kvm_start_guest() stores the backchain, CR and LR all of which
write outside the allocation for the emergency stack. It then creates a
stack frame and saves the non-volatile registers. Unfortunately the
frame it creates is not large enough to fit the non-volatiles, and so
the saving of the non-volatile registers also writes outside the
emergency stack allocation.

The end result is that we corrupt whatever is at 0-24 bytes, and 112-248
bytes above the emergency stack allocation.

In practice this has gone unnoticed because the memory immediately above
the emergency stack happens to be used for other stack allocations,
either another CPUs mc_emergency_sp or an IRQ stack. See the order of
calls to irqstack_early_init() and emergency_stack_init().

The low addresses of another stack are the top of that stack, and so are
only used if that stack is under extreme pressue, which essential

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.14.16-1 (bookworm)	linux 5.14.16-1 (bookworm)
linux	linux	—	—
linux	linux	>= 10d91611f426d4bafd2a83d966c36da811b2f7ad < 80bbb0bc3a0288442f7fe6fc514f4ee1cb06ccb7	80bbb0bc3a0288442f7fe6fc514f4ee1cb06ccb7
linux	linux	>= 10d91611f426d4bafd2a83d966c36da811b2f7ad < fbd724c49bead048ae9fc1a5b7bff2fb3e54f855	fbd724c49bead048ae9fc1a5b7bff2fb3e54f855
linux	linux	>= 10d91611f426d4bafd2a83d966c36da811b2f7ad < 6d077c37c4643394b1bae9682da48164fc147ea8	6d077c37c4643394b1bae9682da48164fc147ea8
linux	linux	>= 10d91611f426d4bafd2a83d966c36da811b2f7ad < 9b4416c5095c20e110c82ae602c254099b83b72f	9b4416c5095c20e110c82ae602c254099b83b72f
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.84-1	5.10.84-1
linux	linux_kernel	>= 0 < 5.14.16-1	5.14.16-1
linux	linux_kernel	>= 0 < 5.14.16-1	5.14.16-1
linux	linux_kernel	>= 0 < 5.14.16-1	5.14.16-1
linux	linux_kernel	>= 5.11 < 5.14.15	5.14.15
linux	linux_kernel	>= 5.2 < 5.4.156	5.4.156
linux	linux_kernel	>= 5.5 < 5.10.76	5.10.76

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-674 CWE-121