In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
platform\/x86\/amd\/hsmp: Reject negative power cap writes in hwmon<\/p>\n
hsmp_hwmon_write() takes the user-supplied hwmon value as a signed long
\nand assigns “val \/ MICROWATT_PER_MILLIWATT” to msg.args[0], which is a
\n__u32. MICROWATT_PER_MILLIWATT is an unsigned long, so a negative write
\nto power1_cap (e.g. “echo -1 > power1_cap”) is first converted to a huge
\nunsigned value by the division and then stored into the u32 argument.<\/p>\n
As a result a nonsensical, multi-gigawatt socket power limit is sent to
\nthe SMU via HSMP_SET_SOCKET_POWER_LIMIT instead of the write being
\nrejected.<\/p>\n
Reject negative values with -EINVAL before the conversion.<\/p>\n
Tested with HSMP enabled:<\/p>\n
CAP=$(dirname $(grep -l amd_hsmp_hwmon
\n \/sys\/class\/hwmon\/hwmon*\/name | head -1))\/power1_cap<\/p>\n
# negative write
\n echo -1000000 > $CAP ; echo “ret=$?”
\n # valid positive write must still work
\n echo 400000000 > $CAP ; echo “ret=$?”<\/p>\n
Before:
\n # echo -1000000 > $CAP ; echo “ret=$?”
\n ret=0 $CAP ; echo “ret=$?”
\n ret=0<\/p>\n
After:
\n # echo -1000000 > $CAP ; echo “ret=$?”
\n bash: echo: write error: Invalid argument
\n ret=1 $CAP ; echo “ret=$?”
\n ret=0 <- valid write still works<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
platform\/x86\/amd\/hsmp: Reject negative power cap writes in hwmon<\/p>\n
hsmp_hwmon_write() takes the user-supplied hwmon value as a signe<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25545","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25545","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25545"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25545"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25545"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}