Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix pti_clone_pgtable() alignment assumption Guenter reported dodgy crashes on an i386-nosmp build using GCC-11 that had the form of endless traps until entry stack exhaust and then #DF from the stack guard. It turned out that pti_clone_pgtable() had alignment assumptions on the start address, notably it hard assumes start is PMD aligned. This is true on x86_64, but very much not true on i386. These assumptions can cause the end condition to malfunction, leading to a 'short' clone. Guess what happens when the user mapping has a short copy of the entry text? Use the correct increment form for addr to avoid alignment assumptions.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 16a3fe634f6a568c6234b8747e5d50487fed3526 before 18da1b27ce16a14a9b636af9232acb4fb24f4c9e; affected 16a3fe634f6a568c6234b8747e5d50487fed3526 before 25a727233a40a9b33370eec9f0cad67d8fd312f8; affected 16a3fe634f6a568c6234b8747e5d50487fed3526 before d00c9b4bbc442d99e1dafbdfdab848bc1ead73f6; affected 16a3fe634f6a568c6234b8747e5d50487fed3526 before 4d143ae782009b43b4f366402e5c37f59d4e4346; affected 16a3fe634f6a568c6234b8747e5d50487fed3526 before 5c580c1050bcbc15c3e78090859d798dcf8c9763; affected 16a3fe634f6a568c6234b8747e5d50487fed3526 before ca07aab70dd3b5e7fddb62d7a6ecd7a7d6d0b2ed; affected 16a3fe634f6a568c6234b8747e5d50487fed3526 before df3eecb5496f87263d171b254ca6e2758ab3c35c; affected 16a3fe634f6a568c6234b8747e5d50487fed3526 before 41e71dbb0e0a0fe214545fe64af031303a08524c |
| Linux / Linux | affected 4.19; unaffected 0 before 4.19; unaffected 4.19.320 through 4.19.*; unaffected 5.4.282 through 5.4.*; unaffected 5.10.224 through 5.10.*; unaffected 5.15.165 through 5.15.*; unaffected 6.1.105 through 6.1.*; unaffected 6.6.46 through 6.6.*; unaffected 6.10.5 through 6.10.*; unaffected 6.11 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/18da1b27ce16a14a9b636af9232acb4fb24f4c9e
- https://git.kernel.org/stable/c/25a727233a40a9b33370eec9f0cad67d8fd312f8
- https://git.kernel.org/stable/c/d00c9b4bbc442d99e1dafbdfdab848bc1ead73f6
- https://git.kernel.org/stable/c/4d143ae782009b43b4f366402e5c37f59d4e4346
- https://git.kernel.org/stable/c/5c580c1050bcbc15c3e78090859d798dcf8c9763
- https://git.kernel.org/stable/c/ca07aab70dd3b5e7fddb62d7a6ecd7a7d6d0b2ed
- https://git.kernel.org/stable/c/df3eecb5496f87263d171b254ca6e2758ab3c35c
- https://git.kernel.org/stable/c/41e71dbb0e0a0fe214545fe64af031303a08524c
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.
No English description supplied.