Received-SPF: pass (google.com: domain of linux-kernel+bounces-187578-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Date: Thu, 23 May 2024 15:32:32 +0200
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Nikolay Borisov <nik.borisov@suse.com>
Cc: cve@kernel.org, linux-kernel@vger.kernel.org
Subject: Re: CVE-2024-35876: x86/mce: Make sure to grab mce_sysfs_mutex in
 set_bank()
Message-ID: <2024052324-glaucoma-legged-34a4@gregkh>
References: <2024051943-CVE-2024-35876-d9b5@gregkh>
 <3eadcc8c-d302-4a70-a16f-604285c1257d@suse.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <3eadcc8c-d302-4a70-a16f-604285c1257d@suse.com>

On Thu, May 23, 2024 at 01:24:33PM +0300, Nikolay Borisov wrote:
> 
> 
> On 19.05.24 г. 11:34 ч., Greg Kroah-Hartman wrote:
> > Description
> > ===========
> > 
> > In the Linux kernel, the following vulnerability has been resolved:
> > 
> > x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()
> > 
> > Modifying a MCA bank's MCA_CTL bits which control which error types to
> > be reported is done over
> > 
> >    /sys/devices/system/machinecheck/
> >    ├── machinecheck0
> >    │   ├── bank0
> >    │   ├── bank1
> >    │   ├── bank10
> >    │   ├── bank11
> >    ...
> > 
> > sysfs nodes by writing the new bit mask of events to enable.
> > 
> > When the write is accepted, the kernel deletes all current timers and
> > reinits all banks.
> > 
> > Doing that in parallel can lead to initializing a timer which is already
> > armed and in the timer wheel, i.e., in use already:
> > 
> >    ODEBUG: init active (active state 0) object: ffff888063a28000 object
> >    type: timer_list hint: mce_timer_fn+0x0/0x240 arch/x86/kernel/cpu/mce/core.c:2642
> >    WARNING: CPU: 0 PID: 8120 at lib/debugobjects.c:514
> >    debug_print_object+0x1a0/0x2a0 lib/debugobjects.c:514
> > 
> > Fix that by grabbing the sysfs mutex as the rest of the MCA sysfs code
> > does.
> > 
> > Reported by: Yue Sun <samsun1006219@gmail.com>
> > Reported by: xingwei lee <xrivendell7@gmail.com>
> > 
> > The Linux kernel CVE team has assigned CVE-2024-35876 to this issue.
> 
> 
> I'd like to dispute the CVE for this issue. Those sysfs entries are owned by
> root and can only be written by it. There are innumerable ways in which root
> can corrupt/crash the state of the machine and I don't see why this is
> anything special.

Good catch, now rejected, thanks!

greg k-h