linux-cve-announce - CVE-2022-50012: powerpc/64: Init jump labels before parse_early

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025061832-CVE-2022-50012-0c32@gregkh>
Date: Wed, 18 Jun 2025 13:01:17 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50012: powerpc/64: Init jump labels before parse_early_param()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

powerpc/64: Init jump labels before parse_early_param()

On 64-bit, calling jump_label_init() in setup_feature_keys() is too
late because static keys may be used in subroutines of
parse_early_param() which is again subroutine of early_init_devtree().

For example booting with "threadirqs":

  static_key_enable_cpuslocked(): static key '0xc000000002953260' used before call to jump_label_init()
  WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xfc/0x120
  ...
  NIP static_key_enable_cpuslocked+0xfc/0x120
  LR  static_key_enable_cpuslocked+0xf8/0x120
  Call Trace:
    static_key_enable_cpuslocked+0xf8/0x120 (unreliable)
    static_key_enable+0x30/0x50
    setup_forced_irqthreads+0x28/0x40
    do_early_param+0xa0/0x108
    parse_args+0x290/0x4e0
    parse_early_options+0x48/0x5c
    parse_early_param+0x58/0x84
    early_init_devtree+0xd4/0x518
    early_setup+0xb4/0x214

So call jump_label_init() just before parse_early_param() in
early_init_devtree().

[mpe: Add call trace to change log and minor wording edits.]

The Linux kernel CVE team has assigned CVE-2022-50012 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.9.326 with commit c4ced9fd10073adc854919976b88ad6004271119
	Fixed in 4.14.291 with commit 8992141cb88f1d99fd11580f4423634700a99240
	Fixed in 4.19.256 with commit 4bb1188e2b1ed98fa2b618cc0628ccba63c6c80f
	Fixed in 5.4.211 with commit 5e14b04c8459afbeea1eeb74e81af86d7b196a4d
	Fixed in 5.10.138 with commit dac28dff90849af4200b8269fcdc84cdc12fa46c
	Fixed in 5.15.63 with commit e3c9e9452a8ea12d335b1e59b2c72e1b99c699b8
	Fixed in 5.19.4 with commit 8f9357313cdcadb0a311b44c29d4eaccc7fa632f
	Fixed in 6.0 with commit ca829e05d3d4f728810cc5e4b468d9ebc7745eb3

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50012
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/powerpc/kernel/prom.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c4ced9fd10073adc854919976b88ad6004271119
	https://git.kernel.org/stable/c/8992141cb88f1d99fd11580f4423634700a99240
	https://git.kernel.org/stable/c/4bb1188e2b1ed98fa2b618cc0628ccba63c6c80f
	https://git.kernel.org/stable/c/5e14b04c8459afbeea1eeb74e81af86d7b196a4d
	https://git.kernel.org/stable/c/dac28dff90849af4200b8269fcdc84cdc12fa46c
	https://git.kernel.org/stable/c/e3c9e9452a8ea12d335b1e59b2c72e1b99c699b8
	https://git.kernel.org/stable/c/8f9357313cdcadb0a311b44c29d4eaccc7fa632f
	https://git.kernel.org/stable/c/ca829e05d3d4f728810cc5e4b468d9ebc7745eb3