CVE-2021-46997

{"id": "CVE-2021-46997", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-02-28T09:15:38.047", "references": [{"url": "https://git.kernel.org/stable/c/4d6a38da8e79e94cbd1344aa90876f0f805db705", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/51524fa8b5f7b879ba569227738375d283b79382", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d8d52005f57bbb4a4ec02f647e2555d327135c68", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e67a83f078005461b59b4c776e6b5addd11725fa", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4d6a38da8e79e94cbd1344aa90876f0f805db705", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://git.kernel.org/stable/c/51524fa8b5f7b879ba569227738375d283b79382", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://git.kernel.org/stable/c/d8d52005f57bbb4a4ec02f647e2555d327135c68", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://git.kernel.org/stable/c/e67a83f078005461b59b4c776e6b5addd11725fa", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: entry: always set GIC_PRIO_PSR_I_SET during entry\n\nZenghui reports that booting a kernel with \"irqchip.gicv3_pseudo_nmi=1\"\non the command line hits a warning during kernel entry, due to the way\nwe manipulate the PMR.\n\nEarly in the entry sequence, we call lockdep_hardirqs_off() to inform\nlockdep that interrupts have been masked (as the HW sets DAIF wqhen\nentering an exception). Architecturally PMR_EL1 is not affected by\nexception entry, and we don't set GIC_PRIO_PSR_I_SET in the PMR early in\nthe exception entry sequence, so early in exception entry the PMR can\nindicate that interrupts are unmasked even though they are masked by\nDAIF.\n\nIf DEBUG_LOCKDEP is selected, lockdep_hardirqs_off() will check that\ninterrupts are masked, before we set GIC_PRIO_PSR_I_SET in any of the\nexception entry paths, and hence lockdep_hardirqs_off() will WARN() that\nsomething is amiss.\n\nWe can avoid this by consistently setting GIC_PRIO_PSR_I_SET during\nexception entry so that kernel code sees a consistent environment. We\nmust also update local_daif_inherit() to undo this, as currently only\ntouches DAIF. For other paths, local_daif_restore() will update both\nDAIF and the PMR. With this done, we can remove the existing special\ncases which set this later in the entry code.\n\nWe always use (GIC_PRIO_IRQON | GIC_PRIO_PSR_I_SET) for consistency with\nlocal_daif_save(), as this will warn if it ever encounters\n(GIC_PRIO_IRQOFF | GIC_PRIO_PSR_I_SET), and never sets this itself. This\nmatches the gic_prio_kentry_setup that we have to retain for\nret_to_user.\n\nThe original splat from Zenghui's report was:\n\n| DEBUG_LOCKS_WARN_ON(!irqs_disabled())\n| WARNING: CPU: 3 PID: 125 at kernel/locking/lockdep.c:4258 lockdep_hardirqs_off+0xd4/0xe8\n| Modules linked in:\n| CPU: 3 PID: 125 Comm: modprobe Tainted: G W 5.12.0-rc8+ #463\n| Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015\n| pstate: 604003c5 (nZCv DAIF +PAN -UAO -TCO BTYPE=--)\n| pc : lockdep_hardirqs_off+0xd4/0xe8\n| lr : lockdep_hardirqs_off+0xd4/0xe8\n| sp : ffff80002a39bad0\n| pmr_save: 000000e0\n| x29: ffff80002a39bad0 x28: ffff0000de214bc0\n| x27: ffff0000de1c0400 x26: 000000000049b328\n| x25: 0000000000406f30 x24: ffff0000de1c00a0\n| x23: 0000000020400005 x22: ffff8000105f747c\n| x21: 0000000096000044 x20: 0000000000498ef9\n| x19: ffff80002a39bc88 x18: ffffffffffffffff\n| x17: 0000000000000000 x16: ffff800011c61eb0\n| x15: ffff800011700a88 x14: 0720072007200720\n| x13: 0720072007200720 x12: 0720072007200720\n| x11: 0720072007200720 x10: 0720072007200720\n| x9 : ffff80002a39bad0 x8 : ffff80002a39bad0\n| x7 : ffff8000119f0800 x6 : c0000000ffff7fff\n| x5 : ffff8000119f07a8 x4 : 0000000000000001\n| x3 : 9bcdab23f2432800 x2 : ffff800011730538\n| x1 : 9bcdab23f2432800 x0 : 0000000000000000\n| Call trace:\n| lockdep_hardirqs_off+0xd4/0xe8\n| enter_from_kernel_mode.isra.5+0x7c/0xa8\n| el1_abort+0x24/0x100\n| el1_sync_handler+0x80/0xd0\n| el1_sync+0x6c/0x100\n| __arch_clear_user+0xc/0x90\n| load_elf_binary+0x9fc/0x1450\n| bprm_execve+0x404/0x880\n| kernel_execve+0x180/0x188\n| call_usermodehelper_exec_async+0xdc/0x158\n| ret_from_fork+0x10/0x18"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: arm64: entrada: configure siempre GIC_PRIO_PSR_I_SET durante la entrada Zenghui informa que al iniciar un kernel con \"irqchip.gicv3_pseudo_nmi=1\" en la l\u00ednea de comando aparece una advertencia durante la entrada del kernel, debido a la forma manipulamos el PMR. Al principio de la secuencia de entrada, llamamos a lockdep_hardirqs_off() para informar a lockdep que las interrupciones han sido enmascaradas (ya que el HW configura DAIF cuando ingresa una excepci\u00f3n). Desde el punto de vista arquitect\u00f3nico, PMR_EL1 no se ve afectado por la entrada de excepci\u00f3n y no configuramos GIC_PRIO_PSR_I_SET en el PMR al principio de la secuencia de entrada de excepci\u00f3n, por lo que al principio de la entrada de excepci\u00f3n el PMR puede indicar que las interrupciones est\u00e1n desenmascaradas aunque est\u00e9n enmascaradas por DAIF. Si se selecciona DEBUG_LOCKDEP, lockdep_hardirqs_off() verificar\u00e1 que las interrupciones est\u00e9n enmascaradas, antes de configurar GIC_PRIO_PSR_I_SET en cualquiera de las rutas de entrada de excepci\u00f3n y, por lo tanto, lockdep_hardirqs_off() ADVERTENCIA() que algo anda mal. Podemos evitar esto configurando consistentemente GIC_PRIO_PSR_I_SET durante la entrada de excepciones para que el c\u00f3digo del kernel vea un entorno consistente. Tambi\u00e9n debemos actualizar local_daif_inherit() para deshacer esto, ya que actualmente solo toca DAIF. Para otras rutas, local_daif_restore() actualizar\u00e1 tanto DAIF como PMR. Una vez hecho esto, podemos eliminar los casos especiales existentes que configuran esto m\u00e1s adelante en el c\u00f3digo de entrada. Siempre usamos (GIC_PRIO_IRQON | GIC_PRIO_PSR_I_SET) para mantener la coherencia con local_daif_save(), ya que esto avisar\u00e1 si alguna vez encuentra (GIC_PRIO_IRQOFF | GIC_PRIO_PSR_I_SET), y nunca lo configura por s\u00ed mismo. Esto coincide con gic_prio_kentry_setup que debemos conservar para ret_to_user. El s\u00edmbolo original del informe de Zenghui fue: | DEBUG_LOCKS_WARN_ON(!irqs_disabled()) | ADVERTENCIA: CPU: 3 PID: 125 en kernel/locking/lockdep.c:4258 lockdep_hardirqs_off+0xd4/0xe8 | M\u00f3dulos enlazados en: | CPU: 3 PID: 125 Comunicaciones: modprobe Contaminado: GW 5.12.0-rc8+ #463 | Nombre del hardware: M\u00e1quina virtual QEMU KVM, BIOS 0.0.0 06/02/2015 | pstate: 604003c5 (nZCv DAIF +PAN -UAO -TCO BTYPE=--) | ordenador personal: lockdep_hardirqs_off+0xd4/0xe8 | lr: lockdep_hardirqs_off+0xd4/0xe8 | sp: ffff80002a39bad0 | pmr_save: 000000e0 | x29: ffff80002a39bad0 x28: ffff0000de214bc0 | x27: ffff0000de1c0400 x26: 000000000049b328 | x25: 0000000000406f30 x24: ffff0000de1c00a0 | x23: 0000000020400005 x22: ffff8000105f747c | x21: 0000000096000044 x20: 0000000000498ef9 | x19: ffff80002a39bc88 x18: ffffffffffffffff | x17: 0000000000000000 x16: ffff800011c61eb0 | x15: ffff800011700a88 x14: 0720072007200720 | x13: 0720072007200720 x12: 0720072007200720 | x11: 0720072007200720 x10: 0720072007200720 | x9: ffff80002a39bad0 x8: ffff80002a39bad0 | x7: ffff8000119f0800 x6: c0000000ffff7fff | x5: ffff8000119f07a8 x4: 0000000000000001 | x3: 9bcdab23f2432800 x2: ffff800011730538 | x1: 9bcdab23f2432800 x0: 0000000000000000 | Rastreo de llamadas: | lockdep_hardirqs_off+0xd4/0xe8 | enter_from_kernel_mode.isra.5+0x7c/0xa8 | el1_abort+0x24/0x100 | el1_sync_handler+0x80/0xd0 | el1_sync+0x6c/0x100 | __arch_clear_user+0xc/0x90 | load_elf_binary+0x9fc/0x1450 | bprm_execve+0x404/0x880 | kernel_execve+0x180/0x188 | call_usermodehelper_exec_async+0xdc/0x158 | ret_from_fork+0x10/0x18"}], "lastModified": "2024-12-24T14:42:47.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8051E54C-C4D7-4B79-90C8-3C0B5A772262", "versionEndExcluding": "5.10.38", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83B53E9A-F426-4C03-9A5F-A931FF79827E", "versionEndExcluding": "5.11.22", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0274929A-B36C-4F4C-AB22-30A0DD6B995B", "versionEndExcluding": "5.12.5", "versionStartIncluding": "5.12"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}