Skip to content

[fips-8.6] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array #270

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
May 19, 2025
Merged

[fips-8.6] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array #270

merged 1 commit into from
May 19, 2025

Conversation

bmastbergen
Copy link
Collaborator

jira VULN-54128
cve CVE-2025-21785

This is an arm64 specific change, which I don't know that we strictly care about in fips branches. But I don't think it hurts to be in there. Since there isn't a current aarch64 fips-8.6 kernel to test against I only ran kselftest against the source built kernel under test. See this PR for lts-8.6 for the same change to see more test results: #232

commit-author Radu Rendec <rrendec@redhat.com>
commit 875d742cf5327c93cba1f11e12b08d3cce7a88d2

The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level).

Fixes: 5d425c186537 ("arm64: kernel: add support for cpu cache information")

	Signed-off-by: Radu Rendec <rrendec@redhat.com>
Link: https://lore.kernel.org/r/20250206174420.2178724-1-rrendec@redhat.com
	Signed-off-by: Will Deacon <will@kernel.org>
(cherry picked from commit 875d742cf5327c93cba1f11e12b08d3cce7a88d2)
	Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>

Build Log

/home/brett/kernel-src-tree
no .config file found, moving on
[TIMER]{MRPROPER}: 0s
aarch64 architecture detected, copying config
'configs/kernel-aarch64.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-b_f-8-c_4.18.0-553.16.1_VULN-54128-6ac224458284"
Making olddefconfig
  HOSTCC  scripts/basic/fixdep
  HOSTCC  scripts/kconfig/conf.o
  YACC    scripts/kconfig/zconf.tab.c
  LEX     scripts/kconfig/zconf.lex.c
  HOSTCC  scripts/kconfig/zconf.tab.o
  HOSTLD  scripts/kconfig/conf
scripts/kconfig/conf  --olddefconfig Kconfig
#
# configuration written to .config
#
Starting Build
scripts/kconfig/conf  --syncconfig Kconfig
  UPD     include/config/kernel.release
  WRAP    arch/arm64/include/generated/uapi/asm/errno.h
  WRAP    arch/arm64/include/generated/uapi/asm/ioctl.h
  WRAP    arch/arm64/include/generated/uapi/asm/ipcbuf.h
  WRAP    arch/arm64/include/generated/uapi/asm/mman.h
  WRAP    arch/arm64/include/generated/uapi/asm/msgbuf.h
  WRAP    arch/arm64/include/generated/uapi/asm/kvm_para.h
  WRAP    arch/arm64/include/generated/uapi/asm/ioctls.h
  WRAP    arch/arm64/include/generated/uapi/asm/poll.h
  WRAP    arch/arm64/include/generated/uapi/asm/resource.h
  WRAP    arch/arm64/include/generated/uapi/asm/sembuf.h
  WRAP    arch/arm64/include/generated/uapi/asm/shmbuf.h
  WRAP    arch/arm64/include/generated/uapi/asm/socket.h
  WRAP    arch/arm64/include/generated/uapi/asm/sockios.h
  WRAP    arch/arm64/include/generated/uapi/asm/swab.h
  WRAP    arch/arm64/include/generated/uapi/asm/termbits.h
  WRAP    arch/arm64/include/generated/uapi/asm/termios.h
  WRAP    arch/arm64/include/generated/uapi/asm/siginfo.h
  WRAP    arch/arm64/include/generated/uapi/asm/types.h
  UPD     include/generated/uapi/linux/version.h
  UPD     include/generated/utsrelease.h
  DESCEND bpf/resolve_btfids
  MKDIR     /home/brett/kernel-src-tree/tools/bpf/resolve_btfids//libsubcmd
  MKDIR     /home/brett/kernel-src-tree/tools/bpf/resolve_btfids//libbpf
  HOSTCC  /home/brett/kernel-src-tree/tools/bpf/resolve_btfids/fixdep.o
  GEN     /home/brett/kernel-src-tree/tools/bpf/resolve_btfids/libbpf/bpf_helper_defs.h
  MKDIR   /home/brett/kernel-src-tree/tools/bpf/resolve_btfids/libbpf/staticobjs/
  CC      /home/brett/kernel-src-tree/tools/bpf/resolve_btfids/libbpf/staticobjs/libbpf.o
  HOSTLD  /home/brett/kernel-src-tree/tools/bpf/resolve_btfids/fixdep-in.o
  MKDIR   /home/brett/kernel-src-tree/tools/bpf/resolve_btfids/libbpf/staticobjs/
  LINK    /home/brett/kernel-src-tree/tools/bpf/resolve_btfids/fixdep
  CC      /home/brett/kernel-src-tree/tools/bpf/resolve_btfids/libbpf/staticobjs/nlattr.o
  CC      /home/brett/kernel-src-tree/tools/bpf/resolve_btfids/libbpf/staticobjs/btf.o
  CC      /home/brett/kernel-src-tree/tools/bpf/resolve_btfids/libbpf/staticobjs/libbpf_errno.o

[SNIP]

  INSTALL net/sched/sch_pie.ko
  INSTALL net/sched/sch_plug.ko
  INSTALL net/sched/sch_prio.ko
  INSTALL net/sched/sch_qfq.ko
  INSTALL net/sched/sch_red.ko
  INSTALL net/sched/sch_sfb.ko
  INSTALL net/sched/sch_sfq.ko
  INSTALL net/sched/sch_tbf.ko
  INSTALL net/sched/sch_teql.ko
  INSTALL net/sctp/sctp.ko
  INSTALL net/sctp/sctp_diag.ko
  INSTALL net/sunrpc/auth_gss/auth_rpcgss.ko
  INSTALL net/sunrpc/auth_gss/rpcsec_gss_krb5.ko
  INSTALL net/sunrpc/sunrpc.ko
  INSTALL net/sunrpc/xprtrdma/rpcrdma.ko
  INSTALL net/tipc/diag.ko
  INSTALL net/tipc/tipc.ko
  INSTALL net/tls/tls.ko
  INSTALL net/unix/unix_diag.ko
  INSTALL net/vmw_vsock/hv_sock.ko
  INSTALL net/vmw_vsock/vmw_vsock_virtio_transport.ko
  INSTALL net/vmw_vsock/vmw_vsock_virtio_transport_common.ko
  INSTALL net/vmw_vsock/vsock.ko
  INSTALL net/vmw_vsock/vsock_diag.ko
  INSTALL net/vmw_vsock/vsock_loopback.ko
  INSTALL net/xdp/xsk_diag.ko
  INSTALL net/xfrm/xfrm_interface.ko
  INSTALL net/xfrm/xfrm_ipcomp.ko
  INSTALL security/keys/encrypted-keys/encrypted-keys.ko
  INSTALL security/keys/trusted-keys/trusted.ko
  INSTALL sound/soundcore.ko
  DEPMOD  4.18.0-b_f-8-c_4.18.0-553.16.1_VULN-54128-6ac224458284+
[TIMER]{MODULES}: 198s
Making Install
/bin/sh ./arch/arm64/boot/install.sh 4.18.0-b_f-8-c_4.18.0-553.16.1_VULN-54128-6ac224458284+ \
arch/arm64/boot/Image System.map "/boot"
[TIMER]{INSTALL}: 1353s
Checking kABI
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-4.18.0-b_f-8-c_4.18.0-553.16.1_VULN-54128-6ac224458284+ and Index to 0
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 0s
[TIMER]{BUILD}: 25164s
[TIMER]{MODULES}: 198s
[TIMER]{INSTALL}: 1353s
[TIMER]{TOTAL} 26970s
Rebooting in 10 seconds

Testing

kselftests were run against the built kernel under test only

selftest-4.18.0-b_f-8-c_4.18.0-553.16.1_VULN-54128-6ac224458284+.log

brett@lycia ~/ciq/vuln-54128 % grep ^ok selftest-4.18.0-b_f-8-c_4.18.0-553.16.1_VULN-54128-6ac224458284+.log | wc -l
167
brett@lycia ~/ciq/vuln-54128 %

@bmastbergen
arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
6ac2244 
jira VULN-54128
cve CVE-2025-21785
commit-author Radu Rendec <rrendec@redhat.com>
commit 875d742

The loop that detects/populates cache information already has a bounds
check on the array size but does not account for cache levels with
separate data/instructions cache. Fix this by incrementing the index
for any populated leaf (instead of any populated level).

Fixes: 5d425c1 ("arm64: kernel: add support for cpu cache information")

	Signed-off-by: Radu Rendec <rrendec@redhat.com>
Link: https://lore.kernel.org/r/20250206174420.2178724-1-rrendec@redhat.com
	Signed-off-by: Will Deacon <will@kernel.org>
(cherry picked from commit 875d742)
	Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>
@PlaidCat
Copy link
Collaborator

PlaidCat commented May 16, 2025 •
edited
Loading

aarch64 currently doesn't ship for fips kernels but should that ever change its in place

PlaidCat
PlaidCat approved these changes May 16, 2025
View reviewed changes
Copy link
Collaborator

@PlaidCat PlaidCat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

thefossguy-ciq
thefossguy-ciq approved these changes May 19, 2025
View reviewed changes
Copy link

@thefossguy-ciq thefossguy-ciq left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚤

@bmastbergen bmastbergen merged commit f4e668d into fips-8-compliant/4.18.0-553.16.1 May 19, 2025
3 checks passed
@bmastbergen bmastbergen deleted the bmastbergen_fips-8-compliant/4.18.0-553.16.1/VULN-54128 branch May 19, 2025 13:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kerneltoast kerneltoast kerneltoast approved these changes

@PlaidCat PlaidCat PlaidCat approved these changes

@thefossguy-ciq thefossguy-ciq thefossguy-ciq approved these changes

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@bmastbergen @PlaidCat @kerneltoast @thefossguy-ciq