CVE-2022-49164

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/tm: Fix more userspace r13 corruption

Commit cf13435b730a ("powerpc/tm: Fix userspace r13 corruption") fixes a

problem in treclaim where a SLB miss can occur on the

thread_struct->ckpt_regs while SCRATCH0 is live with the saved user r13

value, clobbering it with the kernel r13 and ultimately resulting in

kernel r13 being stored in ckpt_regs.

There is an equivalent problem in trechkpt where the user r13 value is

loaded into r13 from chkpt_regs to be recheckpointed, but a SLB miss

could occur on ckpt_regs accesses after that, which will result in r13

being clobbered with a kernel value and that will get recheckpointed and

then restored to user registers.

The same memory page is accessed right before this critical window where

a SLB miss could cause corruption, so hitting the bug requires the SLB

entry be removed within a small window of instructions, which is

possible if a SLB related MCE hits there. PAPR als

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References