ACK: [SRU Jammy, OEM-5.17, Kinetic, OEM-6.0 PATCH 0/5] CVE-2023-0597

[Andrei Gherzan]

On 23/06/08 05:10AM, Cengiz Can wrote:
> [Impact]
> A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping
> of X86 CPU data to memory was found in the way user can guess location of
> exception stack(s) or other important data. A local user could use this flaw
> to get access to some important data with expected location in memory.
> 
> [Fix]
> Although it was initially announced as a single patch, it turned out to be 5
> consecutive patches that depend on each other, indirectly.
> 
> Following is a prerequisite for the fix:
> 
> - 3f148f331814 ("x86/kasan: Map shadow for percpu pages on demand")
> 
> This is the actual fix, that needed a `#include <linux/random.h>` modification
> on anything below 6.0:
> 
> - 97e3d26b5e5f ("x86/mm: Randomize per-cpu entry area")
> 
> These are Fixes to the prerequisite:
> 
> - 80d72a8f76e8 ("x86/mm: Recompute physical address for every page of per-CPU CEA mapping")
> - 97650148a15e ("x86/mm: Populate KASAN shadow for entire per-CPU range of CPU entry area")
> 
> This is a Fixes to the fix:
> 
> - a3f547addcaa ("x86/mm: Do not shuffle CPU entry areas without KASLR")
> 
> [Test case]
> Compile and boot tested, with and without `nokaslr` boot argument.
> 
> [Potential regression]
> Critical.
> This might prevent kernel from booting properly. It affects all users.
> 
> Andrey Ryabinin (1):
>   x86/kasan: Map shadow for percpu pages on demand
> 
> Michal Koutný (1):
>   x86/mm: Do not shuffle CPU entry areas without KASLR
> 
> Peter Zijlstra (1):
>   x86/mm: Randomize per-cpu entry area
> 
> Sean Christopherson (2):
>   x86/mm: Recompute physical address for every page of per-CPU CEA
>     mapping
>   x86/mm: Populate KASAN shadow for entire per-CPU range of CPU entry
>     area
> 
>  arch/x86/include/asm/cpu_entry_area.h |  4 --
>  arch/x86/include/asm/kasan.h          |  3 ++
>  arch/x86/include/asm/pgtable_areas.h  |  8 +++-
>  arch/x86/kernel/hw_breakpoint.c       |  2 +-
>  arch/x86/mm/cpu_entry_area.c          | 57 +++++++++++++++++++++++++--
>  arch/x86/mm/kasan_init_64.c           | 15 +++++--
>  6 files changed, 76 insertions(+), 13 deletions(-)
> 
> -- 
> 2.39.2

Acked-by: Andrei Gherzan <andrei.gherzan at canonical.com>

-- 
Andrei Gherzan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20230609/27ce0036/attachment.sig>