linux-cve-announce - CVE-2024-35996: cpu: Re-enable CPU mitigations by default for !X86 architectures

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024052022-CVE-2024-35996-3f86@gregkh>
Date: Mon, 20 May 2024 11:48:32 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-35996: cpu: Re-enable CPU mitigations by default for !X86 architectures

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

cpu: Re-enable CPU mitigations by default for !X86 architectures

Rename x86's to CPU_MITIGATIONS, define it in generic code, and force it
on for all architectures exception x86.  A recent commit to turn
mitigations off by default if SPECULATION_MITIGATIONS=n kinda sorta
missed that "cpu_mitigations" is completely generic, whereas
SPECULATION_MITIGATIONS is x86-specific.

Rename x86's SPECULATIVE_MITIGATIONS instead of keeping both and have it
select CPU_MITIGATIONS, as having two configs for the same thing is
unnecessary and confusing.  This will also allow x86 to use the knob to
manage mitigations that aren't strictly related to speculative
execution.

Use another Kconfig to communicate to common code that CPU_MITIGATIONS
is already defined instead of having x86's menu depend on the common
CPU_MITIGATIONS.  This allows keeping a single point of contact for all
of x86's mitigations, and it's not clear that other architectures *want*
to allow disabling mitigations at compile-time.

The Linux kernel CVE team has assigned CVE-2024-35996 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 5.15.156 with commit 70688450ddda and fixed in 5.15.158 with commit 36b32816fbab
	Issue introduced in 6.1.87 with commit 9c09773917fb and fixed in 6.1.90 with commit 38f17d1fbb5b
	Issue introduced in 6.6.28 with commit 2978ee7c973c and fixed in 6.6.30 with commit 8292f4f8dd1b
	Issue introduced in 6.8.7 with commit c4a9babdd5d5 and fixed in 6.8.9 with commit fd8547ebc187

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-35996
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	arch/Kconfig
	arch/x86/Kconfig
	kernel/cpu.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/af6d6a923b40bf6471e44067ac61cc5814b48e7f
	https://git.kernel.org/stable/c/36b32816fbab267611f073223f1b0b816ec5920f
	https://git.kernel.org/stable/c/38f17d1fbb5bfb56ca1419e2d06376d57a9396f9
	https://git.kernel.org/stable/c/8292f4f8dd1b005d0688d726261004f816ef730a
	https://git.kernel.org/stable/c/fd8547ebc187037cc69441a15c1441aeaab80f49
	https://git.kernel.org/stable/c/fe42754b94a42d08cf9501790afc25c4f6a5f631