CVE-2022-48762

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

arm64: extable: fix load_unaligned_zeropad() reg indices

In ex_handler_load_unaligned_zeropad() we erroneously extract the data and

addr register indices from ex->type rather than ex->data. As ex->type will

contain EX_TYPE_LOAD_UNALIGNED_ZEROPAD (i.e. 4):

* We'll always treat X0 as the address register, since EX_DATA_REG_ADDR is

extracted from bits [9:5]. Thus, we may attempt to dereference an

arbitrary address as X0 may hold an arbitrary value.

* We'll always treat X4 as the data register, since EX_DATA_REG_DATA is

extracted from bits [4:0]. Thus we will corrupt X4 and cause arbitrary

behaviour within load_unaligned_zeropad() and its caller.

Fix this by extracting both values from ex->data as originally intended.

On an MTE-enabled QEMU image we are hitting the following crash:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000

Call trace:

fixup_exception+0xc4/0x1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References