cve-2025-21632
Vulnerability from cvelistv5
Published
2025-01-19 10:17
Modified
2025-01-20 06:29
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Ensure shadow stack is active before "getting" registers The x86 shadow stack support has its own set of registers. Those registers are XSAVE-managed, but they are "supervisor state components" which means that userspace can not touch them with XSAVE/XRSTOR. It also means that they are not accessible from the existing ptrace ABI for XSAVE state. Thus, there is a new ptrace get/set interface for it. The regset code that ptrace uses provides an ->active() handler in addition to the get/set ones. For shadow stack this ->active() handler verifies that shadow stack is enabled via the ARCH_SHSTK_SHSTK bit in the thread struct. The ->active() handler is checked from some call sites of the regset get/set handlers, but not the ptrace ones. This was not understood when shadow stack support was put in place. As a result, both the set/get handlers can be called with XFEATURE_CET_USER in its init state, which would cause get_xsave_addr() to return NULL and trigger a WARN_ON(). The ssp_set() handler luckily has an ssp_active() check to avoid surprising the kernel with shadow stack behavior when the kernel is not ready for it (ARCH_SHSTK_SHSTK==0). That check just happened to avoid the warning. But the ->get() side wasn't so lucky. It can be called with shadow stacks disabled, triggering the warning in practice, as reported by Christina Schimpe: WARNING: CPU: 5 PID: 1773 at arch/x86/kernel/fpu/regset.c:198 ssp_get+0x89/0xa0 [...] Call Trace: <TASK> ? show_regs+0x6e/0x80 ? ssp_get+0x89/0xa0 ? __warn+0x91/0x150 ? ssp_get+0x89/0xa0 ? report_bug+0x19d/0x1b0 ? handle_bug+0x46/0x80 ? exc_invalid_op+0x1d/0x80 ? asm_exc_invalid_op+0x1f/0x30 ? __pfx_ssp_get+0x10/0x10 ? ssp_get+0x89/0xa0 ? ssp_get+0x52/0xa0 __regset_get+0xad/0xf0 copy_regset_to_user+0x52/0xc0 ptrace_regset+0x119/0x140 ptrace_request+0x13c/0x850 ? wait_task_inactive+0x142/0x1d0 ? do_syscall_64+0x6d/0x90 arch_ptrace+0x102/0x300 [...] Ensure that shadow stacks are active in a thread before looking them up in the XSAVE buffer. Since ARCH_SHSTK_SHSTK and user_ssp[SHSTK_EN] are set at the same time, the active check ensures that there will be something to find in the XSAVE buffer. [ dhansen: changelog/subject tweaks ]
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0a3a872214188e4268d31581ed0cd44508e038cf
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6bfe1fc22f462bec87422cdcbec4d7a2f43ff01d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a9d9c33132d49329ada647e4514d210d15e31d81
Impacted products
Vendor Product Version
Linux Linux Version: 2fab02b25ae7cf5f714ab456b03d9a3fe5ae98c9
Version: 2fab02b25ae7cf5f714ab456b03d9a3fe5ae98c9
Version: 2fab02b25ae7cf5f714ab456b03d9a3fe5ae98c9
 Create a notification for this product.
   Linux Linux Version: 6.6
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/fpu/regset.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0a3a872214188e4268d31581ed0cd44508e038cf",
              "status": "affected",
              "version": "2fab02b25ae7cf5f714ab456b03d9a3fe5ae98c9",
              "versionType": "git"
            },
            {
              "lessThan": "6bfe1fc22f462bec87422cdcbec4d7a2f43ff01d",
              "status": "affected",
              "version": "2fab02b25ae7cf5f714ab456b03d9a3fe5ae98c9",
              "versionType": "git"
            },
            {
              "lessThan": "a9d9c33132d49329ada647e4514d210d15e31d81",
              "status": "affected",
              "version": "2fab02b25ae7cf5f714ab456b03d9a3fe5ae98c9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/fpu/regset.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.72",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Ensure shadow stack is active before \"getting\" registers\n\nThe x86 shadow stack support has its own set of registers. Those registers\nare XSAVE-managed, but they are \"supervisor state components\" which means\nthat userspace can not touch them with XSAVE/XRSTOR.  It also means that\nthey are not accessible from the existing ptrace ABI for XSAVE state.\nThus, there is a new ptrace get/set interface for it.\n\nThe regset code that ptrace uses provides an -\u003eactive() handler in\naddition to the get/set ones. For shadow stack this -\u003eactive() handler\nverifies that shadow stack is enabled via the ARCH_SHSTK_SHSTK bit in the\nthread struct. The -\u003eactive() handler is checked from some call sites of\nthe regset get/set handlers, but not the ptrace ones. This was not\nunderstood when shadow stack support was put in place.\n\nAs a result, both the set/get handlers can be called with\nXFEATURE_CET_USER in its init state, which would cause get_xsave_addr() to\nreturn NULL and trigger a WARN_ON(). The ssp_set() handler luckily has an\nssp_active() check to avoid surprising the kernel with shadow stack\nbehavior when the kernel is not ready for it (ARCH_SHSTK_SHSTK==0). That\ncheck just happened to avoid the warning.\n\nBut the -\u003eget() side wasn\u0027t so lucky. It can be called with shadow stacks\ndisabled, triggering the warning in practice, as reported by Christina\nSchimpe:\n\nWARNING: CPU: 5 PID: 1773 at arch/x86/kernel/fpu/regset.c:198 ssp_get+0x89/0xa0\n[...]\nCall Trace:\n\u003cTASK\u003e\n? show_regs+0x6e/0x80\n? ssp_get+0x89/0xa0\n? __warn+0x91/0x150\n? ssp_get+0x89/0xa0\n? report_bug+0x19d/0x1b0\n? handle_bug+0x46/0x80\n? exc_invalid_op+0x1d/0x80\n? asm_exc_invalid_op+0x1f/0x30\n? __pfx_ssp_get+0x10/0x10\n? ssp_get+0x89/0xa0\n? ssp_get+0x52/0xa0\n__regset_get+0xad/0xf0\ncopy_regset_to_user+0x52/0xc0\nptrace_regset+0x119/0x140\nptrace_request+0x13c/0x850\n? wait_task_inactive+0x142/0x1d0\n? do_syscall_64+0x6d/0x90\narch_ptrace+0x102/0x300\n[...]\n\nEnsure that shadow stacks are active in a thread before looking them up\nin the XSAVE buffer. Since ARCH_SHSTK_SHSTK and user_ssp[SHSTK_EN] are\nset at the same time, the active check ensures that there will be\nsomething to find in the XSAVE buffer.\n\n[ dhansen: changelog/subject tweaks ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-20T06:29:48.375Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0a3a872214188e4268d31581ed0cd44508e038cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bfe1fc22f462bec87422cdcbec4d7a2f43ff01d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9d9c33132d49329ada647e4514d210d15e31d81"
        }
      ],
      "title": "x86/fpu: Ensure shadow stack is active before \"getting\" registers",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21632",
    "datePublished": "2025-01-19T10:17:50.721Z",
    "dateReserved": "2024-12-29T08:45:45.726Z",
    "dateUpdated": "2025-01-20T06:29:48.375Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21632\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-19T11:15:08.650\",\"lastModified\":\"2025-01-19T11:15:08.650\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/fpu: Ensure shadow stack is active before \\\"getting\\\" registers\\n\\nThe x86 shadow stack support has its own set of registers. Those registers\\nare XSAVE-managed, but they are \\\"supervisor state components\\\" which means\\nthat userspace can not touch them with XSAVE/XRSTOR.  It also means that\\nthey are not accessible from the existing ptrace ABI for XSAVE state.\\nThus, there is a new ptrace get/set interface for it.\\n\\nThe regset code that ptrace uses provides an -\u003eactive() handler in\\naddition to the get/set ones. For shadow stack this -\u003eactive() handler\\nverifies that shadow stack is enabled via the ARCH_SHSTK_SHSTK bit in the\\nthread struct. The -\u003eactive() handler is checked from some call sites of\\nthe regset get/set handlers, but not the ptrace ones. This was not\\nunderstood when shadow stack support was put in place.\\n\\nAs a result, both the set/get handlers can be called with\\nXFEATURE_CET_USER in its init state, which would cause get_xsave_addr() to\\nreturn NULL and trigger a WARN_ON(). The ssp_set() handler luckily has an\\nssp_active() check to avoid surprising the kernel with shadow stack\\nbehavior when the kernel is not ready for it (ARCH_SHSTK_SHSTK==0). That\\ncheck just happened to avoid the warning.\\n\\nBut the -\u003eget() side wasn\u0027t so lucky. It can be called with shadow stacks\\ndisabled, triggering the warning in practice, as reported by Christina\\nSchimpe:\\n\\nWARNING: CPU: 5 PID: 1773 at arch/x86/kernel/fpu/regset.c:198 ssp_get+0x89/0xa0\\n[...]\\nCall Trace:\\n\u003cTASK\u003e\\n? show_regs+0x6e/0x80\\n? ssp_get+0x89/0xa0\\n? __warn+0x91/0x150\\n? ssp_get+0x89/0xa0\\n? report_bug+0x19d/0x1b0\\n? handle_bug+0x46/0x80\\n? exc_invalid_op+0x1d/0x80\\n? asm_exc_invalid_op+0x1f/0x30\\n? __pfx_ssp_get+0x10/0x10\\n? ssp_get+0x89/0xa0\\n? ssp_get+0x52/0xa0\\n__regset_get+0xad/0xf0\\ncopy_regset_to_user+0x52/0xc0\\nptrace_regset+0x119/0x140\\nptrace_request+0x13c/0x850\\n? wait_task_inactive+0x142/0x1d0\\n? do_syscall_64+0x6d/0x90\\narch_ptrace+0x102/0x300\\n[...]\\n\\nEnsure that shadow stacks are active in a thread before looking them up\\nin the XSAVE buffer. Since ARCH_SHSTK_SHSTK and user_ssp[SHSTK_EN] are\\nset at the same time, the active check ensures that there will be\\nsomething to find in the XSAVE buffer.\\n\\n[ dhansen: changelog/subject tweaks ]\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0a3a872214188e4268d31581ed0cd44508e038cf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6bfe1fc22f462bec87422cdcbec4d7a2f43ff01d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a9d9c33132d49329ada647e4514d210d15e31d81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.