linux-cve-announce - CVE-2022-48713: perf/x86/intel/pt: Fix crash with stop filters in single-range mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024062054-CVE-2022-48713-6025@gregkh>
Date: Thu, 20 Jun 2024 13:15:53 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-48713: perf/x86/intel/pt: Fix crash with stop filters in single-range mode

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

perf/x86/intel/pt: Fix crash with stop filters in single-range mode

Add a check for !buf->single before calling pt_buffer_region_size in a
place where a missing check can cause a kernel crash.

Fixes a bug introduced by commit 670638477aed ("perf/x86/intel/pt:
Opportunistically use single range output mode"), which added a
support for PT single-range output mode. Since that commit if a PT
stop filter range is hit while tracing, the kernel will crash because
of a null pointer dereference in pt_handle_status due to calling
pt_buffer_region_size without a ToPA configured.

The commit which introduced single-range mode guarded almost all uses of
the ToPA buffer variables with checks of the buf->single variable, but
missed the case where tracing was stopped by the PT hardware, which
happens when execution hits a configured stop filter.

Tested that hitting a stop filter while PT recording successfully
records a trace with this patch but crashes without this patch.

The Linux kernel CVE team has assigned CVE-2022-48713 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 5.5 with commit 670638477aed and fixed in 5.10.99 with commit 456f041e0359
	Issue introduced in 5.5 with commit 670638477aed and fixed in 5.15.22 with commit e83d941fd344
	Issue introduced in 5.5 with commit 670638477aed and fixed in 5.16.8 with commit feffb6ae2c80
	Issue introduced in 5.5 with commit 670638477aed and fixed in 5.17 with commit 1d9093457b24

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-48713
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	arch/x86/events/intel/pt.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/456f041e035913fcedb275aff6f8a71dfebcd394
	https://git.kernel.org/stable/c/e83d941fd3445f660d2f43647c580a320cc384f6
	https://git.kernel.org/stable/c/feffb6ae2c80b9a8206450cdef90f5943baced99
	https://git.kernel.org/stable/c/1d9093457b243061a9bba23543c38726e864a643