In the Linux kernel, the following vulnerability has been resolved: hrtimers: Handle CPU state correctly on hotplug Consider a scenario where a CPU transitions from CPUHP_ONLINE to halfway through a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back to CPUHP_ONLINE: Since hrtimers_prepare_cpu() does not run, cpu_base.hres_active remains set to 1 throughout. However, during a CPU unplug operation, the tick and the clockevents are shut down at CPUHP_AP_TICK_DYING. On return to the online state, for instance CFS incorrectly assumes that the hrtick is already active, and the chance of the clockevent device to transition to oneshot mode is also lost forever for the CPU, unless it goes back to a lower state than CPUHP_HRTIMERS_PREPARE once. This round-trip reveals another issue; cpu_base.online is not set to 1 after the transition, which appears as a WARN_ON_ONCE in enqueue_hrtimer(). Aside of that, the bulk of the per CPU state is not reset either, which means there are dangling pointers in the worst case. Address this by adding a corresponding startup() callback, which resets the stale per CPU state and sets the online flag. [ tglx: Make the new callback unconditionally available, remove the online modification in the prepare() callback and clear the remaining state in the starting callback instead of the prepare callback ]
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: hrtimers: Controlar el estado de la CPU correctamente en hotplug Considere un escenario donde una CPU pasa de CPUHP_ONLINE a la mitad de un hotunplug de CPU hasta CPUHP_HRTIMERS_PREPARE, y luego vuelve a CPUHP_ONLINE: Dado que hrtimers_prepare_cpu() no se ejecuta, cpu_base.hres_active permanece establecido en 1 durante todo el proceso. Sin embargo, durante una operación de desconexión de la CPU, el tick y los clockevents se apagan en CPUHP_AP_TICK_DYING. Al volver al estado en línea, por ejemplo, CFS supone incorrectamente que el hrtick ya está activo, y la posibilidad de que el dispositivo clockevent pase al modo one-shot también se pierde para siempre para la CPU, a menos que vuelva a un estado inferior a CPUHP_HRTIMERS_PREPARE una vez. Este viaje de ida y vuelta revela otro problema; cpu_base.online no se establece en 1 después de la transición, lo que aparece como WARN_ON_ONCE en enqueue_hrtimer(). Aparte de eso, la mayor parte del estado por CPU tampoco se restablece, lo que significa que hay punteros inactivos en el peor de los casos. Resuelva esto agregando una devolución de llamada startup() correspondiente, que restablece el estado obsoleto por CPU y establece el indicador en línea. [ tglx: haga que la nueva devolución de llamada esté disponible incondicionalmente, elimine la modificación en línea en la devolución de llamada prepare() y borre el estado restante en la devolución de llamada de inicio en lugar de la devolución de llamada de preparación ]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-416
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary |
en
CWE-416
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2dbf6eb00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3694e6c80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3694c9840> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36942b3c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2dbf6d300> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2dbf6d9c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b11b640> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd341243180> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd2dbf6ce40> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd2dbf6cc40> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd3694e5040> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd341241e40> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd3694e5f00> | Operating System |
| linux | linux_kernel | 6.13 | <built-in method update of dict object at 0x7fd369a5b1c0> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.13:rc7:*:*:*:*:*:* |