UBUNTU-CVE-2024-39488
In the Linux kernel, the following vulnerability has been resolved: arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY When CONFIG_DEBUG_BUGVERBOSE=n, we fail to add necessary padding bytes to bug_table entries, and as a result the last entry in a bug table will be ignored, potentially leading to an unexpected panic(). All prior entries in the table will be handled correctly. The arm64 ABI requires that struct fields of up to 8 bytes are naturally-aligned, with padding added within a struct such that struct are suitably aligned within arrays. When CONFIG_DEBUG_BUGVERPOSE=y, the layout of a bug_entry is: struct bug_entry { signed int bug_addr_disp; // 4 bytes signed int file_disp; // 4 bytes unsigned short line; // 2 bytes unsigned short flags; // 2 bytes } ... with 12 bytes total, requiring 4-byte alignment. When CONFIG_DEBUG_BUGVERBOSE=n, the layout of a bug_entry is: struct bug_entry { signed int bug_addr_disp; // 4 bytes unsigned short flags; // 2 bytes < implicit padding > // 2 bytes } ... with 8 bytes total, with 6 bytes of data and 2 bytes of trailing padding, requiring 4-byte alginment. When we create a bug_entry in assembly, we align the start of the entry to 4 bytes, which implicitly handles padding for any prior entries. However, we do not align the end of the entry, and so when CONFIG_DEBUG_BUGVERBOSE=n, the final entry lacks the trailing padding bytes. For the main kernel image this is not a problem as find_bug() doesn't depend on the trailing padding bytes when searching for entries: for (bug = __start___bug_table; bug < __stop___bug_table; ++bug) if (bugaddr == bug_addr(bug)) return bug; However for modules, module_bug_finalize() depends on the trailing bytes when calculating the number of entries: mod->num_bugs = sechdrs[i].sh_size / sizeof(struct bug_entry); ... and as the last bug_entry lacks the necessary padding bytes, this entry will not be counted, e.g. in the case of a single entry: sechdrs[i].sh_size == 6 sizeof(struct bug_entry) == 8; sechdrs[i].sh_size / sizeof(struct bug_entry) == 0; Consequently module_find_bug() will miss the last bug_entry when it does: for (i = 0; i < mod->num_bugs; ++i, ++bug) if (bugaddr == bug_addr(bug)) goto out; ... which can lead to a kenrel panic due to an unhandled bug. This can be demonstrated with the following module: static int __init buginit(void) { WARN(1, "hello\n"); return 0; } static void __exit bugexit(void) { } module_init(buginit); module_exit(bugexit); MODULE_LICENSE("GPL"); ... which will trigger a kernel panic when loaded: ------------[ cut here ]------------ hello Unexpected kernel BRK exception at EL1 Internal error: BRK handler: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: hello(O+) CPU: 0 PID: 50 Comm: insmod Tainted: G O 6.9.1 #8 Hardware name: linux,dummy-virt (DT) pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : buginit+0x18/0x1000 [hello] lr : buginit+0x18/0x1000 [hello] sp : ffff800080533ae0 x29: ffff800080533ae0 x28: 0000000000000000 x27: 0000000000000000 x26: ffffaba8c4e70510 x25: ffff800080533c30 x24: ffffaba8c4a28a58 x23: 0000000000000000 x22: 0000000000000000 x21: ffff3947c0eab3c0 x20: ffffaba8c4e3f000 x19: ffffaba846464000 x18: 0000000000000006 x17: 0000000000000000 x16: ffffaba8c2492834 x15: 0720072007200720 x14: 0720072007200720 x13: ffffaba8c49b27c8 x12: 0000000000000312 x11: 0000000000000106 x10: ffffaba8c4a0a7c8 x9 : ffffaba8c49b27c8 x8 : 00000000ffffefff x7 : ffffaba8c4a0a7c8 x6 : 80000000fffff000 x5 : 0000000000000107 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff3947c0eab3c0 Call trace: buginit+0x18/0x1000 [hello] do_one_initcall+0x80/0x1c8 do_init_module+0x60/0x218 load_module+0x1ba4/0x1d70 __do_sys_init_module+0x198/0x1d0 __arm64_sys_init_module+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc ---truncated---
02 / AFFECTED SOFTWARE
Affected packages
12 explicit affected versions
13 explicit affected versions
9 explicit affected versions
37 explicit affected versions
9 explicit affected versions
92 explicit affected versions
37 explicit affected versions
2 explicit affected versions
10 explicit affected versions
31 explicit affected versions
6 explicit affected versions
6 explicit affected versions
35 explicit affected versions
49 explicit affected versions
50 explicit affected versions
6 explicit affected versions
12 explicit affected versions
58 explicit affected versions
10 explicit affected versions
44 explicit affected versions
63 explicit affected versions
54 explicit affected versions
44 explicit affected versions
3 explicit affected versions
9 explicit affected versions
51 explicit affected versions
7 explicit affected versions
50 explicit affected versions
4 explicit affected versions
90 explicit affected versions
35 explicit affected versions
11 explicit affected versions
16 explicit affected versions
18 explicit affected versions
12 explicit affected versions
10 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
13 explicit affected versions
21 explicit affected versions
16 explicit affected versions
12 explicit affected versions
47 explicit affected versions
11 explicit affected versions
7 explicit affected versions
12 explicit affected versions
42 explicit affected versions
7 explicit affected versions
80 explicit affected versions
12 explicit affected versions
95 explicit affected versions
103 explicit affected versions
12 explicit affected versions
4 explicit affected versions
91 explicit affected versions
11 explicit affected versions
5 explicit affected versions
33 explicit affected versions
26 explicit affected versions
13 explicit affected versions
6 explicit affected versions
4 explicit affected versions
29 explicit affected versions
83 explicit affected versions
13 explicit affected versions
55 explicit affected versions
3 explicit affected versions
78 explicit affected versions
53 explicit affected versions
95 explicit affected versions
15 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
12 explicit affected versions
1 explicit affected versions
11 explicit affected versions
12 explicit affected versions
7 explicit affected versions
93 explicit affected versions
42 explicit affected versions
36 explicit affected versions
52 explicit affected versions
10 explicit affected versions
26 explicit affected versions
11 explicit affected versions
29 explicit affected versions
3 explicit affected versions
12 explicit affected versions
13 explicit affected versions
11 explicit affected versions
53 explicit affected versions
16 explicit affected versions
55 explicit affected versions
43 explicit affected versions
3 explicit affected versions
60 explicit affected versions
51 explicit affected versions
9 explicit affected versions
5 explicit affected versions
12 explicit affected versions
41 explicit affected versions
27 explicit affected versions
27 explicit affected versions
8 explicit affected versions
16 explicit affected versions
5 explicit affected versions
8 explicit affected versions
10 explicit affected versions
8 explicit affected versions
82 explicit affected versions
13 explicit affected versions
47 explicit affected versions
7 explicit affected versions
46 explicit affected versions
10 explicit affected versions
13 explicit affected versions
12 explicit affected versions
82 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
41 explicit affected versions
37 explicit affected versions
12 explicit affected versions
38 explicit affected versions
44 explicit affected versions
25 explicit affected versions
44 explicit affected versions
11 explicit affected versions
4 explicit affected versions
52 explicit affected versions
7 explicit affected versions
54 explicit affected versions
4 explicit affected versions
50 explicit affected versions
13 explicit affected versions
43 explicit affected versions
48 explicit affected versions
10 explicit affected versions
8 explicit affected versions
7 explicit affected versions
14 explicit affected versions
83 explicit affected versions
4 explicit affected versions
72 explicit affected versions
1 explicit affected versions
5 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY When CONFIG_DEBUG_BUGVERBOSE=n, we fail to add necessary padding bytes to bug_table entries, and as a result the last entry in a bug table will be ignored, potentially leading to an unexpected panic(). All prior entries in the table will be handled correctly. The arm64 ABI requires that struct fields of up to 8 bytes are naturally-aligned, with padding added within a struct such that struct are suitably aligned within arrays. When CONFIG_DEBUG_BUGVERPOSE=y, the layout of a bug_entry is: struct bug_entry { signed int bug_addr_disp; // 4 bytes signed int file_disp; // 4 bytes unsigned short line; // 2 bytes unsigned short flags; // 2 bytes } ... with 12 bytes total, requiring 4-byte alignment. When CONFIG_DEBUG_BUGVERBOSE=n, the layout of a bug_entry is: struct bug_entry { signed int bug_addr_disp; // 4 bytes unsigned short flags; // 2 bytes < implicit padding > // 2 bytes } ... with 8 bytes total, with 6 bytes of data and 2 bytes of trailing padding, requiring 4-byte alginment. When we create a bug_entry in assembly, we align the start of the entry to 4 bytes, which implicitly handles padding for any prior entries. However, we do not align the end of the entry, and so when CONFIG_DEBUG_BUGVERBOSE=n, the final entry lacks the trailing padding bytes. For the main kernel image this is not a problem as find_bug() doesn't depend on the trailing padding bytes when searching for entries: for (bug = __start___bug_table; bug < __stop___bug_table; ++bug) if (bugaddr == bug_addr(bug)) return bug; However for modules, module_bug_finalize() depends on the trailing bytes when calculating the number of entries: mod->num_bugs = sechdrs[i].sh_size / sizeof(struct bug_entry); ... and as the last bug_entry lacks the necessary padding bytes, this entry will not be counted, e.g. in the case of a single entry: sechdrs[i].sh_size == 6 sizeof(struct bug_entry) == 8; sechdrs[i].sh_size / sizeof(struct bug_entry) == 0; Consequently module_find_bug() will miss the last bug_entry when it does: for (i = 0; i < mod->num_bugs; ++i, ++bug) if (bugaddr == bug_addr(bug)) goto out; ... which can lead to a kenrel panic due to an unhandled bug. This can be demonstrated with the following module: static int __init buginit(void) { WARN(1, "hello\n"); return 0; } static void __exit bugexit(void) { } module_init(buginit); module_exit(bugexit); MODULE_LICENSE("GPL"); ... which will trigger a kernel panic when loaded: ------------[ cut here ]------------ hello Unexpected kernel BRK exception at EL1 Internal error: BRK handler: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: hello(O+) CPU: 0 PID: 50 Comm: insmod Tainted: G O 6.9.1 #8 Hardware name: linux,dummy-virt (DT) pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : buginit+0x18/0x1000 [hello] lr : buginit+0x18/0x1000 [hello] sp : ffff800080533ae0 x29: ffff800080533ae0 x28: 0000000000000000 x27: 0000000000000000 x26: ffffaba8c4e70510 x25: ffff800080533c30 x24: ffffaba8c4a28a58 x23: 0000000000000000 x22: 0000000000000000 x21: ffff3947c0eab3c0 x20: ffffaba8c4e3f000 x19: ffffaba846464000 x18: 0000000000000006 x17: 0000000000000000 x16: ffffaba8c2492834 x15: 0720072007200720 x14: 0720072007200720 x13: ffffaba8c49b27c8 x12: 0000000000000312 x11: 0000000000000106 x10: ffffaba8c4a0a7c8 x9 : ffffaba8c49b27c8 x8 : 00000000ffffefff x7 : ffffaba8c4a0a7c8 x6 : 80000000fffff000 x5 : 0000000000000107 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff3947c0eab3c0 Call trace: buginit+0x18/0x1000 [hello] do_one_initcall+0x80/0x1c8 do_init_module+0x60/0x218 load_module+0x1ba4/0x1d70 __do_sys_init_module+0x198/0x1d0 __arm64_sys_init_module+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc ---truncated---
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/ffbf4fb9b5c12ff878a10ea17997147ea4ebea6f
- https://git.kernel.org/stable/c/22469a0335a1a1a690349b58bcb55822457df81e
- https://git.kernel.org/stable/c/3fd487ffaa697ddb05af78a75aaaddabe71c52b0
- https://git.kernel.org/stable/c/461a760d578b2b2c2faac3040b6b7c77baf128f8
- https://git.kernel.org/stable/c/9f2ad88f9b349554f64e4037ec185c84d7dd9c7d
- https://git.kernel.org/stable/c/c1929c041a262a4a27265db8dce3619c92aa678c
- https://git.kernel.org/stable/c/c27a2f7668e215c1ebbccd96fab27a220a93f1f7
- https://git.kernel.org/stable/c/f221bd58db0f6ca087ac0392284f6bce21f4f8ea
- https://git.kernel.org/stable/c/ffbf4fb9b5c12ff878a10ea17997147ea4ebea6f
- https://ubuntu.com/security/CVE-2024-39488
- https://ubuntu.com/security/notices/USN-6951-1
- https://ubuntu.com/security/notices/USN-6951-2
- https://ubuntu.com/security/notices/USN-6951-3
- https://ubuntu.com/security/notices/USN-6951-4
- https://ubuntu.com/security/notices/USN-6953-1
- https://ubuntu.com/security/notices/USN-6979-1
- https://ubuntu.com/security/notices/USN-6999-1
- https://ubuntu.com/security/notices/USN-6999-2
- https://ubuntu.com/security/notices/USN-7004-1
- https://ubuntu.com/security/notices/USN-7005-1
- https://ubuntu.com/security/notices/USN-7005-2
- https://ubuntu.com/security/notices/USN-7007-1
- https://ubuntu.com/security/notices/USN-7007-2
- https://ubuntu.com/security/notices/USN-7007-3
- https://ubuntu.com/security/notices/USN-7008-1
- https://ubuntu.com/security/notices/USN-7009-1
- https://ubuntu.com/security/notices/USN-7009-2
- https://ubuntu.com/security/notices/USN-7019-1
- https://ubuntu.com/security/notices/USN-7029-1
- https://www.cve.org/CVERecord?id=CVE-2024-39488