CVE-2024-36926

powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE

At the time of LPAR boot up, partition firmware provides Open Firmware
property ibm,dma-window for the PE. This property is provided on the PCI
bus the PE is attached to.

There are execptions where the partition firmware might not provide this
property for the PE at the time of LPAR boot up. One of the scenario is
where the firmware has frozen the PE due to some error condition. This
PE is frozen for 24 hours or unless the whole system is reinitialized.

Within this time frame, if the LPAR is booted, the frozen PE will be
presented to the LPAR but ibm,dma-window property could be missing.

Today, under these circumstances, the LPAR oopses with NULL pointer
dereference, when configuring the PCI bus the PE is attached to.

BUG: Kernel NULL pointer dereference on read at 0x000000c8
Faulting instruction address: 0xc0000000001024c0
Oops: Kernel access of bad area, sig: 7 [#1]
LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
Modules linked in:
Supported: Yes
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.4.0-150600.9-default #1
Hardware name: IBM,9043-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_023) hv:phyp pSeries
NIP: c0000000001024c0 LR: c0000000001024b0 CTR: c000000000102450
REGS: c0000000037db5c0 TRAP: 0300 Not tainted (6.4.0-150600.9-default)
MSR: 8000000002009033 <SF,VEC,EE,ME,IR,DR,RI,LE> CR: 28000822 XER: 00000000
CFAR: c00000000010254c DAR: 00000000000000c8 DSISR: 00080000 IRQMASK: 0
...
NIP [c0000000001024c0] pci_dma_bus_setup_pSeriesLP+0x70/0x2a0
LR [c0000000001024b0] pci_dma_bus_setup_pSeriesLP+0x60/0x2a0
Call Trace:
pci_dma_bus_setup_pSeriesLP+0x60/0x2a0 (unreliable)
pcibios_setup_bus_self+0x1c0/0x370
__of_scan_bus+0x2f8/0x330
pcibios_scan_phb+0x280/0x3d0
pcibios_init+0x88/0x12c
do_one_initcall+0x60/0x320
kernel_init_freeable+0x344/0x3e4
kernel_init+0x34/0x1d0
ret_from_kernel_user_thread+0x14/0x1c

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: powerpc/pseries/iommu: LPAR entra en pánico durante el arranque con un PE congelado En el momento del arranque de LPAR, el firmware de la partición proporciona la propiedad Open Firmware ibm,dma-window para el PE. Esta propiedad se proporciona en el bus PCI al que está conectado el PE. Hay excepciones en las que es posible que el firmware de la partición no proporcione esta propiedad para el PE en el momento del arranque de LPAR. Uno de los escenarios es donde el firmware ha congelado el PE debido a alguna condición de error. Este PE se congela durante 24 horas o a menos que se reinicialice todo el sistema. Dentro de este período de tiempo, si se inicia la LPAR, el PE congelado se presentará a la LPAR, pero es posible que falte la propiedad ibm,dma-window. Hoy en día, bajo estas circunstancias, la LPAR falla con la desreferencia del puntero NULL al configurar el bus PCI al que está conectado el PE. ERROR: Desreferencia del puntero NULL del kernel al leer en 0x000000c8 Dirección de instrucción errónea: 0xc0000000001024c0 Ups: Acceso al kernel del área defectuosa, firma: 7 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 Módulos NUMA pSeries vinculados en: Compatible: Sí CPU: 0 PID: 1 Comunicaciones: swapper/0 No contaminado 6.4.0-150600.9-default #1 Nombre de hardware: IBM,9043-MRX POWER10 (sin procesar) 0x800200 0xf000006 de:IBM,FW1060.00 (NM1060_023) hv:phyp pSeries NIP: c0000000001024c0 LR: c0000000001024b0 CTR: c000000000102450 REGS: c0000000037db5c0 TRAP: 0300 No contaminado (6.4.0-150600.9-predeterminado) MSR: 800000000200 9033 CR: 28000822 XER : 00000000 CFAR: c00000000010254c DAR: 00000000000000c8 DSISR: 00080000 IRQMASK: 0 ... NIP [c0000000001024c0] pci_dma_bus_setup_pSeriesLP+0x70/0x2a0 LR [c0000 000001024b0] pci_dma_bus_setup_pSeriesLP+0x60/0x2a0 Seguimiento de llamadas: pci_dma_bus_setup_pSeriesLP+0x60/0x2a0 (no confiable) pcibios_setup_bus_self+0x1c0/ 0x370 __of_scan_bus+0x2f8/0x330 pcibios_scan_phb+0x280/0x3d0 pcibios_init+0x88/0x12c do_one_initcall+0x60/0x320 kernel_init_freeable+0x344/0x3e4 kernel_init+0x34/0x1d0 _usuario_thread+0x14/0x1c

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-30 CVE Reserved
2024-05-30 CVE Published
2024-06-11 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-476: NULL Pointer Dereference

CAPEC

References (7)

URL	Tag	Source
https://git.kernel.org/stable/c/b1fc44eaa9ba31e28c4125d6b9205a3582b47b5d	Vuln. Introduced
https://git.kernel.org/stable/c/b9f08b2649dddd4eb0698cb428b173bb01dd2fc5	Vuln. Introduced
https://git.kernel.org/stable/c/58942f672c6d04b6a3cd7866cb459671df881538	Vuln. Introduced

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/7fb5793c53f8c024e3eae9f0d44eb659aed833c4	2024-05-17
https://git.kernel.org/stable/c/802b13b79ab1fef66c6852fc745cf197dca0cb15	2024-05-17
https://git.kernel.org/stable/c/2bed905a72485a2b79a001bd7e66c750942d2155	2024-05-17
https://git.kernel.org/stable/c/49a940dbdc3107fecd5e6d3063dc07128177e058	2024-04-23

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 6.0 < 6.1.91 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.0 < 6.1.91"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 6.0 < 6.6.31 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.0 < 6.6.31"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 6.0 < 6.8.10 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.0 < 6.8.10"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 6.0 < 6.9 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.0 < 6.9"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				5.18.18 Search vendor "Linux" for product "Linux Kernel" and version "5.18.18"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				5.19.2 Search vendor "Linux" for product "Linux Kernel" and version "5.19.2"		en		Affected