CVE-2022-49067

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit

mpe: On 64-bit Book3E vmalloc space starts at 0x8000000000000000.

Because of the way __pa() works we have:

__pa(0x8000000000000000) == 0, and therefore

virt_to_pfn(0x8000000000000000) == 0, and therefore

virt_addr_valid(0x8000000000000000) == true

Which is wrong, virt_addr_valid() should be false for vmalloc space.

In fact all vmalloc addresses that alias with a valid PFN will return

true from virt_addr_valid(). That can cause bugs with hardened usercopy

as described below by Kefeng Wang:

When running ethtool eth0 on 64-bit Book3E, a BUG occurred:

usercopy: Kernel memory exposure attempt detected from SLUB object not in SLUB page?! (offset 0, size 1048)!

kernel BUG at mm/usercopy.c:99

...

usercopy_abort+0x64/0xa0 (unreliable)

__check_heap_object+0x168/0x190

__check_object_size+0x1a0/0x200

dev_ethtool+0x2494/0x2b20

de

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References