linux-kernel - "BUG: unable to handle kernel paging request in DataTLBError" in Linux Kernel Version 2.6.32

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAKHoSAsjBpfS5REyfRWJz3GA8PSLnXEE3wi2Dq9oJb-jYLjkUg@mail.gmail.com>
Date: Mon, 2 Dec 2024 12:31:26 +0800
From: cheung wall <zzqq0103.hey@...il.com>
To: linux-kernel@...r.kernel.org
Subject: "BUG: unable to handle kernel paging request in DataTLBError" in
 Linux Kernel Version 2.6.32

Hello,

I am writing to report a potential vulnerability identified in the
Linux Kernel version 2.6.32, specifically on the PowerPC architecture.
This issue was discovered using our custom vulnerability discovery
tool.

Detailed Report:

fsetxattr$security_ima(r10, &(0x7f0000006f00),
&(0x7f0000006f40)=@...{0x3, 0x1, "508395"}, 0x5, 0x2)
close(r1)
ioctl$FIONCLEX(0xffffffffffffffff, 0x20006602)
#executor: Prog has number of calls = 30
#invalid syscall number call_num=18446744073709551614
Unable to handle kernel paging request for data at address 0xd64c6b9b
MSR: 00001000 <ME> CR: 82000822 XER: 20000000
TASK = c0591330[-1065942759] '
GPR00: fffedb15 c05cbe10 c0591330 c05935f0 c0591330 00000000 00000000 00000000
GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
NIP [c0000ed8] DataTLBError+0x58/0xa0
Call Trace:
3d60c058 616bd000 7d919aa6 558c0402 7d919ba6 4800000c 7d7342a6 816b0010
Kernel panic - not syncing: Fatal exception in interrupt

Root Cause:

The root cause of this issue lies in an invalid memory access
triggered during the handling of a kernel page fault in the
DataTLBError function, which is responsible for addressing data TLB
misses. The paging request failure occurs at an invalid address
(0xd64c6b9b), likely due to an invalid or corrupted pointer passed to
a system call such as fsetxattr or ioctl. The lack of proper
validation for inputs or kernel state during these operations results
in a fatal exception, causing the kernel to panic while attempting to
handle the interrupt. This indicates a vulnerability in the kernel's
error handling and input sanitization mechanisms for system calls
interacting with low-level memory or TLB management.

Thank you for your time and attention.

Best regards

Wall