linux-cve-announce - CVE-2025-22033: arm64: Don't call NULL in do_compat_alignment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2025041657-CVE-2025-22033-566b@gregkh>
Date: Wed, 16 Apr 2025 16:12:04 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2025-22033: arm64: Don't call NULL in do_compat_alignment_fixup()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

arm64: Don't call NULL in do_compat_alignment_fixup()

do_alignment_t32_to_handler() only fixes up alignment faults for
specific instructions; it returns NULL otherwise (e.g. LDREX). When
that's the case, signal to the caller that it needs to proceed with the
regular alignment fault handling (i.e. SIGBUS). Without this patch, the
kernel panics:

  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
  Mem abort info:
    ESR = 0x0000000086000006
    EC = 0x21: IABT (current EL), IL = 32 bits
    SET = 0, FnV = 0
    EA = 0, S1PTW = 0
    FSC = 0x06: level 2 translation fault
  user pgtable: 4k pages, 48-bit VAs, pgdp=00000800164aa000
  [0000000000000000] pgd=0800081fdbd22003, p4d=0800081fdbd22003, pud=08000815d51c6003, pmd=0000000000000000
  Internal error: Oops: 0000000086000006 [#1] SMP
  Modules linked in: cfg80211 rfkill xt_nat xt_tcpudp xt_conntrack nft_chain_nat xt_MASQUERADE nf_nat nf_conntrack_netlink nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xfrm_user xfrm_algo xt_addrtype nft_compat br_netfilter veth nvme_fa>
   libcrc32c crc32c_generic raid0 multipath linear dm_mod dax raid1 md_mod xhci_pci nvme xhci_hcd nvme_core t10_pi usbcore igb crc64_rocksoft crc64 crc_t10dif crct10dif_generic crct10dif_ce crct10dif_common usb_common i2c_algo_bit i2c>
  CPU: 2 PID: 3932954 Comm: WPEWebProcess Not tainted 6.1.0-31-arm64 #1  Debian 6.1.128-1
  Hardware name: GIGABYTE MP32-AR1-00/MP32-AR1-00, BIOS F18v (SCP: 1.08.20211002) 12/01/2021
  pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
  pc : 0x0
  lr : do_compat_alignment_fixup+0xd8/0x3dc
  sp : ffff80000f973dd0
  x29: ffff80000f973dd0 x28: ffff081b42526180 x27: 0000000000000000
  x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
  x23: 0000000000000004 x22: 0000000000000000 x21: 0000000000000001
  x20: 00000000e8551f00 x19: ffff80000f973eb0 x18: 0000000000000000
  x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
  x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
  x11: 0000000000000000 x10: 0000000000000000 x9 : ffffaebc949bc488
  x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
  x5 : 0000000000400000 x4 : 0000fffffffffffe x3 : 0000000000000000
  x2 : ffff80000f973eb0 x1 : 00000000e8551f00 x0 : 0000000000000001
  Call trace:
   0x0
   do_alignment_fault+0x40/0x50
   do_mem_abort+0x4c/0xa0
   el0_da+0x48/0xf0
   el0t_32_sync_handler+0x110/0x140
   el0t_32_sync+0x190/0x194
  Code: bad PC value
  ---[ end trace 0000000000000000 ]---

The Linux kernel CVE team has assigned CVE-2025-22033 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.1 with commit 3fc24ef32d3b9368f4c103dcd21d6a3f959b4870 and fixed in 6.1.134 with commit cf187601053ecaf671ae645edb898901f81d03e9
	Issue introduced in 6.1 with commit 3fc24ef32d3b9368f4c103dcd21d6a3f959b4870 and fixed in 6.6.87 with commit 617a4b0084a547917669fef2b54253cc9c064990
	Issue introduced in 6.1 with commit 3fc24ef32d3b9368f4c103dcd21d6a3f959b4870 and fixed in 6.12.23 with commit 2df8ee605eb6806cd41c2095306db05206633a08
	Issue introduced in 6.1 with commit 3fc24ef32d3b9368f4c103dcd21d6a3f959b4870 and fixed in 6.13.11 with commit fa2a9f625f185c6acb4ee5be8d71359a567afac9
	Issue introduced in 6.1 with commit 3fc24ef32d3b9368f4c103dcd21d6a3f959b4870 and fixed in 6.14.2 with commit ecf798573bbe0805803f7764e12a34b4bcc65074
	Issue introduced in 6.1 with commit 3fc24ef32d3b9368f4c103dcd21d6a3f959b4870 and fixed in 6.15-rc1 with commit c28f31deeacda307acfee2f18c0ad904e5123aac

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-22033
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/arm64/kernel/compat_alignment.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/cf187601053ecaf671ae645edb898901f81d03e9
	https://git.kernel.org/stable/c/617a4b0084a547917669fef2b54253cc9c064990
	https://git.kernel.org/stable/c/2df8ee605eb6806cd41c2095306db05206633a08
	https://git.kernel.org/stable/c/fa2a9f625f185c6acb4ee5be8d71359a567afac9
	https://git.kernel.org/stable/c/ecf798573bbe0805803f7764e12a34b4bcc65074
	https://git.kernel.org/stable/c/c28f31deeacda307acfee2f18c0ad904e5123aac