In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()<\/p>\n
KUAP means kernel cannot touch user memory unless it explicitly is
\nenabled. In the kernel it should stay AMR_KUAP_BLOCKED. While returning
\nto userspace just before RFI, kernel should restore the user AMR value
\nback.<\/p>\n
Looks like GENERIC_ENTRY might be treating arch_exit_to_user_mode_prepare()
\nas the last architecture step before returning to userspace.
\ncommit bee25f97ad24 (“powerpc: Enable GENERIC_ENTRY feature”)
\ntherefore called kuap_user_restore() from that hook. But on PowerPC that
\nis too early. After irqentry_exit() \/ syscall_exit_to_user_mode() we
\nstill run platform specific exit routines.<\/p>\n
e.g. code snippets showing both exception handling and system call
\nhandling as the callers of function arch_exit_to_user_mode_prepare()
\nwhich does kuap_user_restore(). The below path shows that calling
\nkuap_user_restore() is too early when called from
\narch_exit_to_user_mode_prepare().<\/p>\n
Exception handling in exceptions-64s.S
\n=======================================<\/p>\n
bl\tCFUNC(do_page_fault)
\n\t ..DEFINE_INTERRUPT_HANDLER_ASYNC(do_page_fault)
\n\t arch_interrupt_async_enter_prepare(regs);
\n\t state = irqentry_enter(regs);
\n\t instrumentation_begin();
\n\t irq_enter_rcu();
\n\t handler(regs);
\n\t nap_adjust_return(regs);
\n\t irq_exit_rcu();
\n\t instrumentation_end();
\n\t arch_interrupt_async_exit_prepare(regs);
\n\t irqentry_exit(regs, state); \t\t <<< too early
\n\t irqentry_exit_to_user_mode()
\n\t\t __exit_to_user_mode_prepare(regs, EXIT_TO_USER_MODE_WORK_IRQ);
\n\t\t arch_exit_to_user_mode_prepare(regs, ti_work); <<< too early
\nb\tinterrupt_return_srr
\n\t\t.. bl\tCFUNC(interrupt_exit_user_prepare) <<< already calls kuap_user_restore<\/p>\n
prep_irq_for_enabled_exit() retry can run kernel code with IRQs on. So
\nonly when that routine is fully finished is when the user KUAP should be
\nfully restored which interrupt_exit_user_prepare() already takes care of
\nbefore returning.<\/p>\n
Similarly for system call handling in interrupt_64.S
\n======================================================<\/p>\n
\tbl\tCFUNC(system_call_exception)<\/p>\n
.Lsyscall_exit:
\n\taddi\tr4,r1,STACK_INT_FRAME_REGS
\n\tli\tr5,0 \/* !scv *\/
\n\tbl\tCFUNC(syscall_exit_prepare)
\n\t\t .. kuap_assert_locked();
\n\t\t syscall_exit_to_user_mode(regs); <<< too early
\n\t\t syscall_exit_to_user_mode_prepare(regs); <<< too early
\n \t\t kuap_user_restore(regs); <<< already calls<\/p>\n
syscall_exit_prepare(), which can enable IRQs, replay a pending
\ninterrupt, and only then rfi. Those functions already restore KUAP
\nimmediately before rfi.<\/p>\n
Note that if we restore the user AMR too early like in the current code
\nas shown from the code snippets above, then we get the following warning
\nwhen CONFIG_PPC_KUAP_DEBUG is enabled:
\n WARNING: arch\/powerpc\/include\/asm\/book3s\/64\/kup.h:293 at interrupt_exit_user_prepare+0x1a0\/0x1c0
\n Hardware name: IBM pSeries (emulated by qemu) POWER10 (architected)
\n TRAP: 0700
\n LR: c00000000000d8d4 CTR: c0000000021fe500
\n MSR: CR: 44000804 XER: 20040000
\n interrupt_exit_user_prepare+0x1a0\/0x1c0
\n interrupt_return_srr_user+0x8\/0x12c<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()<\/p>\n
KUAP means kernel cannot touch user memory unless it explicitly i<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-39067","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/39067","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=39067"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=39067"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=39067"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}