In the Linux kernel, the following vulnerability has been resolved: x86/mtrr: Check if fixed MTRRs exist before saving them MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed variant has a separate capability bit in the MTRR capability MSR. So far all x86 CPUs which support MTRR have this separate bit set, so it went unnoticed that mtrr_save_state() does not check the capability bit before accessing the fixed MTRR MSRs. Though on a CPU that does not support the fixed MTRR capability this results in a #GP. The #GP itself is harmless because the RDMSR fault is handled gracefully, but results in a WARN_ON(). Add the missing capability check to prevent this.
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/mtrr: comprobar si existen MTRR fijos antes de guardarlos Los MTRR tienen una variante fija obsoleta para el control de almacenamiento en caché de grano fino de la región de 640K-1MB que utiliza MSR separados. Esta variante fija tiene un bit de capacidad independiente en el MSR de capacidad MTRR. Hasta ahora, todas las CPU x86 que admiten MTRR tienen este bit independiente configurado, por lo que pasó desapercibido que mtrr_save_state() no comprueba el bit de capacidad antes de acceder a los MSR MTRR fijos. Aunque en una CPU que no admite la capacidad MTRR fija, esto da como resultado un #GP. El #GP en sí es inofensivo porque el error RDMSR se maneja con elegancia, pero da como resultado un WARN_ON(). Agregue la comprobación de capacidad faltante para evitar esto.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd37019f040> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b437580> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2a1d9c6c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b57cf00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd37019c640> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd37019c400> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b436e00> | Operating System |
| linux | linux_kernel | 6.11 | <built-in method update of dict object at 0x7fd36b57c080> | Operating System |
| linux | linux_kernel | 6.11 | <built-in method update of dict object at 0x7fd36b30e2c0> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:* |