| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025120853-CVE-2022-50625-a1e2@gregkh> Date: Mon, 8 Dec 2025 10:17:02 +0900 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2022-50625: serial: amba-pl011: avoid SBSA UART accessing DMACR register From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: avoid SBSA UART accessing DMACR register Chapter "B Generic UART" in "ARM Server Base System Architecture" [1] documentation describes a generic UART interface. Such generic UART does not support DMA. In current code, sbsa_uart_pops and amba_pl011_pops share the same stop_rx operation, which will invoke pl011_dma_rx_stop, leading to an access of the DMACR register. This commit adds a using_rx_dma check in pl011_dma_rx_stop to avoid the access to DMACR register for SBSA UARTs which does not support DMA. When the kernel enables DMA engine with "CONFIG_DMA_ENGINE=y", Linux SBSA PL011 driver will access PL011 DMACR register in some functions. For most real SBSA Pl011 hardware implementations, the DMACR write behaviour will be ignored. So these DMACR operations will not cause obvious problems. But for some virtual SBSA PL011 hardware, like Xen virtual SBSA PL011 (vpl011) device, the behaviour might be different. Xen vpl011 emulation will inject a data abort to guest, when guest is accessing an unimplemented UART register. As Xen VPL011 is SBSA compatible, it will not implement DMACR register. So when Linux SBSA PL011 driver access DMACR register, it will get an unhandled data abort fault and the application will get a segmentation fault: Unhandled fault at 0xffffffc00944d048 Mem abort info: ESR = 0x96000000 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x00: ttbr address size fault Data abort info: ISV = 0, ISS = 0x00000000 CM = 0, WnR = 0 swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000020e2e000 [ffffffc00944d048] pgd=100000003ffff803, p4d=100000003ffff803, pud=100000003ffff803, pmd=100000003fffa803, pte=006800009c090f13 Internal error: ttbr address size fault: 96000000 [#1] PREEMPT SMP ... Call trace: pl011_stop_rx+0x70/0x80 tty_port_shutdown+0x7c/0xb4 tty_port_close+0x60/0xcc uart_close+0x34/0x8c tty_release+0x144/0x4c0 __fput+0x78/0x220 ____fput+0x1c/0x30 task_work_run+0x88/0xc0 do_notify_resume+0x8d0/0x123c el0_svc+0xa8/0xc0 el0t_64_sync_handler+0xa4/0x130 el0t_64_sync+0x1a0/0x1a4 Code: b9000083 b901f001 794038a0 8b000042 (b9000041) ---[ end trace 83dd93df15c3216f ]--- note: bootlogd[132] exited with preempt_count 1 /etc/rcS.d/S07bootlogd: line 47: 132 Segmentation fault start-stop-daemon This has been discussed in the Xen community, and we think it should fix this in Linux. See [2] for more information. [1] https://developer.arm.com/documentation/den0094/c/?lang=en [2] https://lists.xenproject.org/archives/html/xen-devel/2022-11/msg00543.html The Linux kernel CVE team has assigned CVE-2022-50625 to this issue. Affected and fixed versions =========================== Issue introduced in 4.2 with commit 0dd1e247fd39aed20fd2baacc62ca44d82534798 and fixed in 4.9.337 with commit 1c5f0d3f480abd8c26761b6b1f486822e77faea3 Issue introduced in 4.2 with commit 0dd1e247fd39aed20fd2baacc62ca44d82534798 and fixed in 4.14.303 with commit a4ea20ab82aa2b197dc7b08f51e1d615578276a0 Issue introduced in 4.2 with commit 0dd1e247fd39aed20fd2baacc62ca44d82534798 and fixed in 4.19.270 with commit 78d837ce20517e0c1ff3ebe08ad64636e02c2e48 Issue introduced in 4.2 with commit 0dd1e247fd39aed20fd2baacc62ca44d82534798 and fixed in 5.4.229 with commit 965f07ea5fd1b9591bcccc825a93ad883e56222c Issue introduced in 4.2 with commit 0dd1e247fd39aed20fd2baacc62ca44d82534798 and fixed in 5.10.163 with commit d5b16eb076f46c88d02d41ece5bec4e0d89158bb Issue introduced in 4.2 with commit 0dd1e247fd39aed20fd2baacc62ca44d82534798 and fixed in 5.15.86 with commit d71a611fca1984c0765f9317ff471ac8cd0e3e2f Issue introduced in 4.2 with commit 0dd1e247fd39aed20fd2baacc62ca44d82534798 and fixed in 6.0.16 with commit 38a10fdd54d17590d45cb1c43b9889da383b6b1a Issue introduced in 4.2 with commit 0dd1e247fd39aed20fd2baacc62ca44d82534798 and fixed in 6.1.2 with commit 64bc5dbc3260230e2f022288c71e5c680059384a Issue introduced in 4.2 with commit 0dd1e247fd39aed20fd2baacc62ca44d82534798 and fixed in 6.2 with commit 94cdb9f33698478b0e7062586633c42c6158a786 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-50625 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/tty/serial/amba-pl011.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/1c5f0d3f480abd8c26761b6b1f486822e77faea3 https://git.kernel.org/stable/c/a4ea20ab82aa2b197dc7b08f51e1d615578276a0 https://git.kernel.org/stable/c/78d837ce20517e0c1ff3ebe08ad64636e02c2e48 https://git.kernel.org/stable/c/965f07ea5fd1b9591bcccc825a93ad883e56222c https://git.kernel.org/stable/c/d5b16eb076f46c88d02d41ece5bec4e0d89158bb https://git.kernel.org/stable/c/d71a611fca1984c0765f9317ff471ac8cd0e3e2f https://git.kernel.org/stable/c/38a10fdd54d17590d45cb1c43b9889da383b6b1a https://git.kernel.org/stable/c/64bc5dbc3260230e2f022288c71e5c680059384a https://git.kernel.org/stable/c/94cdb9f33698478b0e7062586633c42c6158a786
Powered by blists - more mailing lists