Skip to content

[LTS 9.4] VULN-34947 and VULN-129818 #574

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
shreeya-patel98 merged 2 commits into from
Sep 17, 2025
Merged

[LTS 9.4] VULN-34947 and VULN-129818 #574

shreeya-patel98 merged 2 commits into from
Sep 17, 2025

Conversation

@shreeya-patel98
Copy link
Collaborator

@shreeya-patel98 shreeya-patel98 commented Sep 16, 2025

  • Commit Message Requirements
  • Built against Vault/LTS Environment
  • kABI Check Passed, where Valid (Pre 9.4 RT does not have kABI stability)
  • Boot Test
  • Kernel SelfTest results
  • Additional Tests as determined relevant

Commit message

   x86/srso: Add SRSO mitigation for Hygon processors
    
    jira VULN-34947
    cve CVE-2023-52482
    commit-author Pu Wen <puwen@hygon.cn>
    commit a5ef7d68cea1344cf524f04981c2b3f80bedbb0d
    
    Add mitigation for the speculative return stack overflow vulnerability
    which exists on Hygon processors too.
    
-----------------------–––––––––––––––––––––––––––––––––––––––––––––––––

    xfrm: interface: fix use-after-free after changing collect_md xfrm interface
    
    jira VULN-129818
    cve CVE-2025-38500
    commit-author Eyal Birger <eyal.birger@gmail.com>
    commit a90b2a1aaacbcf0f91d7e4868ad6c51c5dee814b
    
    collect_md property on xfrm interfaces can only be set on device creation,
    thus xfrmi_changelink() should fail when called on such interfaces.
    
    The check to enforce this was done only in the case where the xi was
    returned from xfrmi_locate() which doesn't look for the collect_md
    interface, and thus the validation was never reached.
    
    Calling changelink would thus errornously place the special interface xi
    in the xfrmi_net->xfrmi hash, but since it also exists in the
    xfrmi_net->collect_md_xfrmi pointer it would lead to a double free when
    the net namespace was taken down [1].
    
    Change the check to use the xi from netdev_priv which is available earlier
    in the function to prevent changes in xfrm collect_md interfaces.
    
    [1] resulting oops:
    [    8.516540] kernel BUG at net/core/dev.c:12029!
    [    8.516552] Oops: invalid opcode: 0000 [#1] SMP NOPTI
    [    8.516559] CPU: 0 UID: 0 PID: 12 Comm: kworker/u80:0 Not tainted 6.15.0-virtme #5 PREEMPT(voluntary)
    [    8.516565] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
    [    8.516569] Workqueue: netns cleanup_net
    [    8.516579] RIP: 0010:unregister_netdevice_many_notify+0x101/0xab0
    [    8.516590] Code: 90 0f 0b 90 48 8b b0 78 01 00 00 48 8b 90 80 01 00 00 48 89 56 08 48 89 32 4c 89 80 78 01 00 00 48 89 b8 80 01 00 00 eb ac 90 <0f> 0b 48 8b 45 00 4c 8d a0 88 fe ff ff 48 39 c5 74 5c 41 80 bc 24
    [    8.516593] RSP: 0018:ffffa93b8006bd30 EFLAGS: 00010206
    [    8.516598] RAX: ffff98fe4226e000 RBX: ffffa93b8006bd58 RCX: ffffa93b8006bc60
    [    8.516601] RDX: 0000000000000004 RSI: 0000000000000000 RDI: dead000000000122
    [    8.516603] RBP: ffffa93b8006bdd8 R08: dead000000000100 R09: ffff98fe4133c100
    [    8.516605] R10: 0000000000000000 R11: 00000000000003d2 R12: ffffa93b8006be00
    [    8.516608] R13: ffffffff96c1a510 R14: ffffffff96c1a510 R15: ffffa93b8006be00
    [    8.516615] FS:  0000000000000000(0000) GS:ffff98fee73b7000(0000) knlGS:0000000000000000
    [    8.516619] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [    8.516622] CR2: 00007fcd2abd0700 CR3: 000000003aa40000 CR4: 0000000000752ef0
    [    8.516625] PKRU: 55555554
    [    8.516627] Call Trace:
    [    8.516632]  <TASK>
    [    8.516635]  ? rtnl_is_locked+0x15/0x20
    [    8.516641]  ? unregister_netdevice_queue+0x29/0xf0
    [    8.516650]  ops_undo_list+0x1f2/0x220
    [    8.516659]  cleanup_net+0x1ad/0x2e0
    [    8.516664]  process_one_work+0x160/0x380
    [    8.516673]  worker_thread+0x2aa/0x3c0
    [    8.516679]  ? __pfx_worker_thread+0x10/0x10
    [    8.516686]  kthread+0xfb/0x200
    [    8.516690]  ? __pfx_kthread+0x10/0x10
    [    8.516693]  ? __pfx_kthread+0x10/0x10
    [    8.516697]  ret_from_fork+0x82/0xf0
    [    8.516705]  ? __pfx_kthread+0x10/0x10
    [    8.516709]  ret_from_fork_asm+0x1a/0x30
    [    8.516718]  </TASK>

Kernel build logs

/mnt/scratch/workspace/ciqlts9_4/ciqlts9_4-lts94-9-2025_07_28__13_26_58/kernel-src-tree
Skipping make mrproper
[TIMER]{MRPROPER}: 0s
x86_64 architecture detected, copying config
'configs/kernel-x86_64-rhel.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-shreeya_ciqlts9_4-3e08eb70906c"
Making olddefconfig
#
# configuration written to .config
#
Starting Build
  SYNC    include/config/auto.conf.cmd
  WRAP    arch/x86/include/generated/asm/early_ioremap.h
  WRAP    arch/x86/include/generated/asm/export.h
  WRAP    arch/x86/include/generated/asm/irq_regs.h
  WRAP    arch/x86/include/generated/asm/kmap_size.h
  WRAP    arch/x86/include/generated/asm/local64.h
  WRAP    arch/x86/include/generated/asm/mmiowb.h
  WRAP    arch/x86/include/generated/asm/rwonce.h
  WRAP    arch/x86/include/generated/asm/module.lds.h
  WRAP    arch/x86/include/generated/asm/unaligned.h
  WRAP    arch/x86/include/generated/asm/mcs_spinlock.h
  HOSTCC  scripts/bin2c
  HOSTCC  scripts/kallsyms
  HOSTCC  scripts/sorttable
  HOSTCC  scripts/asn1_compiler
  <--snip-->
  axff.ko
  SIGN    /lib/modules/5.14.0-shreeya_ciqlts9_4-3e08eb70906c+/kernel/drivers/hid/hid-axff.ko
  DEPMOD  /lib/modules/5.14.0-shreeya_ciqlts9_4-3e08eb70906c+
[TIMER]{MODULES}: 9s
Making Install
sh ./arch/x86/boot/install.sh 5.14.0-shreeya_ciqlts9_4-3e08eb70906c+ \
	arch/x86/boot/bzImage System.map "/boot"
[TIMER]{INSTALL}: 21s
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-5.14.0-shreeya_ciqlts9_4-3e08eb70906c+ and Index to 3
The default is /boot/loader/entries/d84955f323dc42758d1fc6865f813ef4-5.14.0-shreeya_ciqlts9_4-3e08eb70906c+.conf with index 3 and kernel /boot/vmlinuz-5.14.0-shreeya_ciqlts9_4-3e08eb70906c+
The default is /boot/loader/entries/d84955f323dc42758d1fc6865f813ef4-5.14.0-shreeya_ciqlts9_4-3e08eb70906c+.conf with index 3 and kernel /boot/vmlinuz-5.14.0-shreeya_ciqlts9_4-3e08eb70906c+
Generating grub configuration file ...
Adding boot menu entry for UEFI Firmware Settings ...
done
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 0s
[TIMER]{BUILD}: 1588s
[TIMER]{MODULES}: 9s
[TIMER]{INSTALL}: 21s
[TIMER]{TOTAL} 1621s
Rebooting in 10 seconds

kernel-build.log

Kselftests

shreeya@spatel-dev-bom:~/ciq/workspace/ciqlts9_4$ grep '^ok ' kselftest-before.log | wc -l && grep '^ok ' kselftest-after.log | wc -l
329
328
shreeya@spatel-dev-bom:~/ciq/workspace/ciqlts9_4$ grep '^not ok ' kselftest-before.log | wc -l && grep '^not ok ' kselftest-after.log | wc -l
71
72

Note :- Failure is not related to the change

kselftest-after.log
kselftest-before.log

Tuxsuite Build Test

https://tuxapi.tuxsuite.com/v1/groups/ciq/projects/spatel/builds/32kffR1LemJgZeoU3UoUYHBdG4x

@shreeya-patel98
xfrm: interface: fix use-after-free after changing collect_md xfrm in…
a6d781e 
…terface

jira VULN-129818
cve CVE-2025-38500
commit-author Eyal Birger <eyal.birger@gmail.com>
commit a90b2a1

collect_md property on xfrm interfaces can only be set on device creation,
thus xfrmi_changelink() should fail when called on such interfaces.

The check to enforce this was done only in the case where the xi was
returned from xfrmi_locate() which doesn't look for the collect_md
interface, and thus the validation was never reached.

Calling changelink would thus errornously place the special interface xi
in the xfrmi_net->xfrmi hash, but since it also exists in the
xfrmi_net->collect_md_xfrmi pointer it would lead to a double free when
the net namespace was taken down [1].

Change the check to use the xi from netdev_priv which is available earlier
in the function to prevent changes in xfrm collect_md interfaces.

[1] resulting oops:
[    8.516540] kernel BUG at net/core/dev.c:12029!
[    8.516552] Oops: invalid opcode: 0000 [#1] SMP NOPTI
[    8.516559] CPU: 0 UID: 0 PID: 12 Comm: kworker/u80:0 Not tainted 6.15.0-virtme #5 PREEMPT(voluntary)
[    8.516565] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[    8.516569] Workqueue: netns cleanup_net
[    8.516579] RIP: 0010:unregister_netdevice_many_notify+0x101/0xab0
[    8.516590] Code: 90 0f 0b 90 48 8b b0 78 01 00 00 48 8b 90 80 01 00 00 48 89 56 08 48 89 32 4c 89 80 78 01 00 00 48 89 b8 80 01 00 00 eb ac 90 <0f> 0b 48 8b 45 00 4c 8d a0 88 fe ff ff 48 39 c5 74 5c 41 80 bc 24
[    8.516593] RSP: 0018:ffffa93b8006bd30 EFLAGS: 00010206
[    8.516598] RAX: ffff98fe4226e000 RBX: ffffa93b8006bd58 RCX: ffffa93b8006bc60
[    8.516601] RDX: 0000000000000004 RSI: 0000000000000000 RDI: dead000000000122
[    8.516603] RBP: ffffa93b8006bdd8 R08: dead000000000100 R09: ffff98fe4133c100
[    8.516605] R10: 0000000000000000 R11: 00000000000003d2 R12: ffffa93b8006be00
[    8.516608] R13: ffffffff96c1a510 R14: ffffffff96c1a510 R15: ffffa93b8006be00
[    8.516615] FS:  0000000000000000(0000) GS:ffff98fee73b7000(0000) knlGS:0000000000000000
[    8.516619] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    8.516622] CR2: 00007fcd2abd0700 CR3: 000000003aa40000 CR4: 0000000000752ef0
[    8.516625] PKRU: 55555554
[    8.516627] Call Trace:
[    8.516632]  <TASK>
[    8.516635]  ? rtnl_is_locked+0x15/0x20
[    8.516641]  ? unregister_netdevice_queue+0x29/0xf0
[    8.516650]  ops_undo_list+0x1f2/0x220
[    8.516659]  cleanup_net+0x1ad/0x2e0
[    8.516664]  process_one_work+0x160/0x380
[    8.516673]  worker_thread+0x2aa/0x3c0
[    8.516679]  ? __pfx_worker_thread+0x10/0x10
[    8.516686]  kthread+0xfb/0x200
[    8.516690]  ? __pfx_kthread+0x10/0x10
[    8.516693]  ? __pfx_kthread+0x10/0x10
[    8.516697]  ret_from_fork+0x82/0xf0
[    8.516705]  ? __pfx_kthread+0x10/0x10
[    8.516709]  ret_from_fork_asm+0x1a/0x30
[    8.516718]  </TASK>

Fixes: abc340b ("xfrm: interface: support collect metadata mode")
	Reported-by: Lonial Con <kongln9170@gmail.com>
	Signed-off-by: Eyal Birger <eyal.birger@gmail.com>
	Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit a90b2a1)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
@shreeya-patel98
x86/srso: Add SRSO mitigation for Hygon processors
01ce431 
jira VULN-34947
cve CVE-2023-52482
commit-author Pu Wen <puwen@hygon.cn>
commit a5ef7d6

Add mitigation for the speculative return stack overflow vulnerability
which exists on Hygon processors too.

	Signed-off-by: Pu Wen <puwen@hygon.cn>
	Signed-off-by: Ingo Molnar <mingo@kernel.org>
	Acked-by: Borislav Petkov (AMD) <bp@alien8.de>
	Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/tencent_4A14812842F104E93AA722EC939483CEFF05@qq.com
(cherry picked from commit a5ef7d6)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>
bmastbergen
bmastbergen approved these changes Sep 16, 2025
View reviewed changes
Copy link
Collaborator

@bmastbergen bmastbergen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

PlaidCat
PlaidCat approved these changes Sep 16, 2025
View reviewed changes
Copy link
Collaborator

@PlaidCat PlaidCat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for trying to get TuxSuite to work and it got pretty far.

Our current SOP stuff looks good though
:shipit:

@shreeya-patel98 shreeya-patel98 merged commit 8083357 into ciqlts9_4 Sep 17, 2025
5 checks passed
@shreeya-patel98 shreeya-patel98 deleted the {shreeya}_ciqlts9_4 branch September 17, 2025 09:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@PlaidCat PlaidCat PlaidCat approved these changes

@bmastbergen bmastbergen bmastbergen approved these changes

@kerneltoast kerneltoast Awaiting requested review from kerneltoast

@thefossguy-ciq thefossguy-ciq Awaiting requested review from thefossguy-ciq

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@shreeya-patel98 @PlaidCat @bmastbergen