{"uuid": "dc1a9efa-d147-4425-8b02-28fe04bb122c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39488", "type": "published-proof-of-concept", "source": "https://t.me/cvedetector/531", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-39488 - In the Linux kernel, the following vulnerability h\", \n  \"Content\": \"CVE ID : CVE-2024-39488 \nPublished : July 10, 2024, 8:15 a.m. | 35\u00a0minutes ago \nDescription : In the Linux kernel, the following vulnerability has been resolved:  \n  \narm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY  \n  \nWhen CONFIG_DEBUG_BUGVERBOSE=n, we fail to add necessary padding bytes  \nto bug_table entries, and as a result the last entry in a bug table will  \nbe ignored, potentially leading to an unexpected panic(). All prior  \nentries in the table will be handled correctly.  \n  \nThe arm64 ABI requires that struct fields of up to 8 bytes are  \nnaturally-aligned, with padding added within a struct such that struct  \nare suitably aligned within arrays.  \n  \nWhen CONFIG_DEBUG_BUGVERPOSE=y, the layout of a bug_entry is:  \n  \n struct bug_entry {  \n  signed int      bug_addr_disp; // 4 bytes  \n  signed int      file_disp; // 4 bytes  \n  unsigned short  line;  // 2 bytes  \n  unsigned short  flags;  // 2 bytes  \n }  \n  \n... with 12 bytes total, requiring 4-byte alignment.  \n  \nWhen CONFIG_DEBUG_BUGVERBOSE=n, the layout of a bug_entry is:  \n  \n struct bug_entry {  \n  signed int      bug_addr_disp; // 4 bytes  \n  unsigned short  flags;  // 2 bytes  \n    // 2 bytes  \n }  \n  \n... with 8 bytes total, with 6 bytes of data and 2 bytes of trailing  \npadding, requiring 4-byte alginment.  \n  \nWhen we create a bug_entry in assembly, we align the start of the entry  \nto 4 bytes, which implicitly handles padding for any prior entries.  \nHowever, we do not align the end of the entry, and so when  \nCONFIG_DEBUG_BUGVERBOSE=n, the final entry lacks the trailing padding  \nbytes.  \n  \nFor the main kernel image this is not a problem as find_bug() doesn't  \ndepend on the trailing padding bytes when searching for entries:  \n  \n for (bug = __start___bug_table; bug num_bugs = sechdrs[i].sh_size / sizeof(struct bug_entry);  \n  \n... and as the last bug_entry lacks the necessary padding bytes, this entry  \nwill not be counted, e.g. in the case of a single entry:  \n  \n sechdrs[i].sh_size == 6  \n sizeof(struct bug_entry) == 8;  \n  \n sechdrs[i].sh_size / sizeof(struct bug_entry) == 0;  \n  \nConsequently module_find_bug() will miss the last bug_entry when it does:  \n  \n for (i = 0; i num_bugs; ++i, ++bug)  \n  if (bugaddr == bug_addr(bug))  \n   goto out;  \n  \n... which can lead to a kenrel panic due to an unhandled bug.  \n  \nThis can be demonstrated with the following module:  \n  \n static int __init buginit(void)  \n {  \n  WARN(1, \"hello\\n\");  \n  return 0;  \n }  \n  \n static void __exit bugexit(void)  \n {  \n }  \n  \n module_init(buginit);  \n module_exit(bugexit);  \n MODULE_LICENSE(\"GPL\");  \n  \n... which will trigger a kernel panic when loaded:  \n  \n ------------[ cut here ]------------  \n hello  \n Unexpected kernel BRK exception at EL1  \n Internal error: BRK handler: 00000000f2000800 [#1] PREEMPT SMP  \n Modules linked in: hello(O+)  \n CPU: 0 PID: 50 Comm: insmod Tainted: G           O       6.9.1 #8  \n Hardware name: linux,dummy-virt (DT)  \n pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)  \n pc : buginit+0x18/0x1000 [hello]  \n lr : buginit+0x18/0x1000 [hello]  \n sp : ffff800080533ae0  \n x29: ffff800080533ae0 x28: 0000000000000000 x27: 0000000000000000  \n x26: ffffaba8c4e70510 x25: ffff800080533c30 x24: ffffaba8c4a28a58  \n x23: 0000000000000000 x22: 0000000000000000 x21: ffff3947c0eab3c0  \n x20: ffffaba8c4e3f000 x19: ffffaba846464000 x18: 0000000000000006  \n x17: 0000000000000000 x16: ffffaba8c2492834 x15: 0720072007200720  \n x14: 0720072007200720 x13: ffffaba8c49b27c8 x12: 0000000000000312  \n x11: 0000000000000106 x10: ffffaba8c4a0a7c8 x9 : ffffaba8c49b27c8  \n x8 : 00000000ffffefff x7 : ffffaba8c4a0a7c8 x6 : 80000000fffff000  \n x5 : 0000000000000107 x4 : 0000000000000000 x3 : 0000000000000000  \n x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff3947c0eab3c0  \n Call trace:  \n  buginit+0x18/0x1000 [hello]  \n  do_one_initcall+0x80/0x1c8  \n  do_init_module+0x60/0x218  [...]", "creation_timestamp": "2024-07-10T10:54:49.000000Z"}