linux-kernel - Re: [PATCH] x86/boot: Sanitize boot params before parsing command line

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <qtxxvlrhgvok5k4spffhqw7ztvfn7djo55wg6bjvqwofkgroqa@y2ncocp3th42>
Date: Fri, 7 Mar 2025 13:57:33 +0200
From: "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
To: Ard Biesheuvel <ardb+git@...gle.com>
Cc: linux-kernel@...r.kernel.org, x86@...nel.org, 
	Ard Biesheuvel <ardb@...nel.org>, stable@...r.kernel.org, "H. Peter Anvin" <hpa@...or.com>, 
	Ulrich Gemkow <ulrich.gemkow@....uni-stuttgart.de>
Subject: Re: [PATCH] x86/boot: Sanitize boot params before parsing command
 line

On Thu, Mar 06, 2025 at 04:59:16PM +0100, Ard Biesheuvel wrote:
> From: Ard Biesheuvel <ardb@...nel.org>
> 
> The 5-level paging code parses the command line to look for the 'no5lvl'
> string, and does so very early, before sanitize_boot_params() has been
> called and has been given the opportunity to wipe bogus data from the
> fields in boot_params that are not covered by struct setup_header, and
> are therefore supposed to be initialized to zero by the bootloader.
> 
> This triggers an early boot crash when using syslinux-efi to boot a
> recent kernel built with CONFIG_X86_5LEVEL=y and CONFIG_EFI_STUB=n, as
> the 0xff padding that now fills the unused PE/COFF header is copied into
> boot_params by the bootloader, and interpreted as the top half of the
> command line pointer.
> 
> Fix this by sanitizing the boot_params before use. Note that there is no
> harm in calling this more than once; subsequent invocations are able to
> spot that the boot_params have already been cleaned up.
> 
> Cc: <stable@...r.kernel.org> # v6.1+
> Cc: "H. Peter Anvin" <hpa@...or.com>
> Cc: "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
> Cc: Ulrich Gemkow <ulrich.gemkow@....uni-stuttgart.de>
> Closes: https://lore.kernel.org/all/202503041549.35913.ulrich.gemkow@ikr.uni-stuttgart.de
> Signed-off-by: Ard Biesheuvel <ardb@...nel.org>

Acked-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>

-- 
  Kiryl Shutsemau / Kirill A. Shutemov