CVE-2024-42240

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/bhi: Avoid warning in #DB handler due to BHI mitigation

When BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set

then entry_SYSENTER_compat() uses CLEAR_BRANCH_HISTORY and calls the

clear_bhb_loop() before the TF flag is cleared. This causes the #DB handler

(exc_debug_kernel()) to issue a warning because single-step is used outside the

entry_SYSENTER_compat() function.

To address this issue, entry_SYSENTER_compat() should use CLEAR_BRANCH_HISTORY

after making sure the TF flag is cleared.

The problem can be reproduced with the following sequence:

$ cat sysenter_step.c

int main()

{ asm("pushf; pop %ax; bts $8,%ax; push %ax; popf; sysenter"); }

$ gcc -o sysenter_step sysenter_step.c

$ ./sysenter_step

Segmentation fault (core dumped)

The program is expected to crash, and the #DB handler will issue a warning.

Kernel log:

WARNING: CPU: 27 PID: 7000 at arch/x86/kernel/traps.c:100

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References