CVE-2024-26706

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

parisc: Fix random data corruption from exception handler

The current exception handler implementation, which assists when accessing

user space memory, may exhibit random data corruption if the compiler decides

to use a different register than the specified register %r29 (defined in

ASM_EXCEPTIONTABLE_REG) for the error code. If the compiler choose another

register, the fault handler will nevertheless store -EFAULT into %r29 and thus

trash whatever this register is used for.

Looking at the assembly I found that this happens sometimes in emulate_ldd().

To solve the issue, the easiest solution would be if it somehow is

possible to tell the fault handler which register is used to hold the error

code. Using %0 or %1 in the inline assembly is not posssible as it will show

up as e.g. %r29 (with the "%r" prefix), which the GNU assembler can not

convert to an integer.

This patch takes another, better and more flexible appr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References