linux-kernel - x86/mce: Potential Information Leak in __mce_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAPbMC766gbD52cADhXwK0BC-gN-pmTa0+4Kk4+hyM6LfAWrhJg@mail.gmail.com>
Date: Thu, 30 Jan 2025 20:27:47 +0800
From: Haoyu Li <lihaoyu499@...il.com>
To: Tony Luck <tony.luck@...el.com>, Borislav Petkov <bp@...en8.de>, 
	Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, 
	Dave Hansen <dave.hansen@...ux.intel.com>, "H. Peter Anvin" <hpa@...or.com>, linux-edac@...r.kernel.org
Cc: x86@...nel.org, linux-kernel@...r.kernel.org, chenyuan0y@...il.com
Subject: x86/mce: Potential Information Leak in __mce_read_apei Due to
 Uninitialized Bytes

Dear Linux Kernel Developers,

I hope this email finds you well.

I would like to bring to your attention a potential issue in the
"__mce_read_apei" function. Specifically, the struct mce m is
initialized via the "apei_read_mce" function before being copied to
user space. However, upon inspecting the call trace (apei_read_mce ->
erst_read_record -> erst_read), we found that not all fields of struct
mce are properly initialized.

This could lead to an information leakage due to uninitialized bytes
being exposed to user space.

Could you please confirm if this is a valid concern? Looking forward
to your insights.

Best regards,
Haoyu Li