In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
openrisc: signal: do not restore privileged SR bits on sigreturn<\/p>\n
restore_sigcontext() copies the whole supervision register (SR) from the
\nsignal frame and only clears SPR_SR_SM before the value is reloaded into
\nthe hardware SR (through ESR and l.rfe) on the return to user space. All
\nother SR bits are left under user control.<\/p>\n
An unprivileged task can thus return from a signal handler through a
\ncrafted sigframe that clears SPR_SR_DME. With the data MMU disabled the
\nCPU performs no translation or protection on data accesses, so the task
\ngains read and write access to arbitrary physical memory, a local
\nprivilege escalation. SPR_SR_IME, SPR_SR_SUMRA, SPR_SR_LEE, SPR_SR_EPH
\nand the cache-enable bits are exposed the same way. The ptrace GPR regset
\nalready refuses any change to SR for exactly this reason.<\/p>\n
Restore only the arithmetic flag bits (F, CY, OV) from the signal frame
\nand take every privileged control bit from the SR the kernel saved on
\nsignal entry.<\/p>\n
Verified with qemu-system-or1k -M or1k-sim: before this change an
\nunprivileged PoC clears SPR_SR_DME in rt_sigreturn and writes a marker to
\nphysical address 0x03000000 (beyond the kernel’s mem=32M); afterwards the
\nsame PoC receives SIGSEGV and physical memory is unchanged.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
openrisc: signal: do not restore privileged SR bits on sigreturn<\/p>\n
restore_sigcontext() copies the whole supervision register (SR) f<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11965","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11965","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11965"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11965"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11965"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}