linux-cve-announce - CVE-2025-38055: perf/x86/intel: Fix segfault with PEBS-via-PT with sample

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025061833-CVE-2025-38055-896f@gregkh>
Date: Wed, 18 Jun 2025 11:33:50 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38055: perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

perf/x86/intel: Fix segfault with PEBS-via-PT with sample_freq

Currently, using PEBS-via-PT with a sample frequency instead of a sample
period, causes a segfault.  For example:

    BUG: kernel NULL pointer dereference, address: 0000000000000195
    <NMI>
    ? __die_body.cold+0x19/0x27
    ? page_fault_oops+0xca/0x290
    ? exc_page_fault+0x7e/0x1b0
    ? asm_exc_page_fault+0x26/0x30
    ? intel_pmu_pebs_event_update_no_drain+0x40/0x60
    ? intel_pmu_pebs_event_update_no_drain+0x32/0x60
    intel_pmu_drain_pebs_icl+0x333/0x350
    handle_pmi_common+0x272/0x3c0
    intel_pmu_handle_irq+0x10a/0x2e0
    perf_event_nmi_handler+0x2a/0x50

That happens because intel_pmu_pebs_event_update_no_drain() assumes all the
pebs_enabled bits represent counter indexes, which is not always the case.
In this particular case, bits 60 and 61 are set for PEBS-via-PT purposes.

The behaviour of PEBS-via-PT with sample frequency is questionable because
although a PMI is generated (PEBS_PMI_AFTER_EACH_RECORD), the period is not
adjusted anyway.

Putting that aside, fix intel_pmu_pebs_event_update_no_drain() by passing
the mask of counter bits instead of 'size'.  Note, prior to the Fixes
commit, 'size' would be limited to the maximum counter index, so the issue
was not hit.

The Linux kernel CVE team has assigned CVE-2025-38055 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.11 with commit 722e42e45c2f1c6d1adec7813651dba5139f52f4 and fixed in 6.12.31 with commit ca51db23166767a8445deb8331c9b8d5205d9287
	Issue introduced in 6.11 with commit 722e42e45c2f1c6d1adec7813651dba5139f52f4 and fixed in 6.14.9 with commit 0b1874a5b1173fbcb2185ab828f4c33d067e551e
	Issue introduced in 6.11 with commit 722e42e45c2f1c6d1adec7813651dba5139f52f4 and fixed in 6.15 with commit 99bcd91fabada0dbb1d5f0de44532d8008db93c6
	Issue introduced in 6.10.5 with commit a9d6d466bcf0621a872e1052bc40e4c6f0541b8d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38055
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/x86/events/intel/ds.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ca51db23166767a8445deb8331c9b8d5205d9287
	https://git.kernel.org/stable/c/0b1874a5b1173fbcb2185ab828f4c33d067e551e
	https://git.kernel.org/stable/c/99bcd91fabada0dbb1d5f0de44532d8008db93c6