Received-SPF: pass (google.com: domain of linux-kernel+bounces-187599-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1;
Message-ID: <a7bc8570-4001-43b6-902f-d45de27fcb02@oracle.com>
Date: Thu, 23 May 2024 15:54:39 +0200
User-Agent: Mozilla Thunderbird
Subject: Re: CVE-2024-35876: x86/mce: Make sure to grab mce_sysfs_mutex in
 set_bank()
To: Nikolay Borisov <nik.borisov@suse.com>, cve@kernel.org,
        linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
References: <2024051943-CVE-2024-35876-d9b5@gregkh>
 <3eadcc8c-d302-4a70-a16f-604285c1257d@suse.com>
Content-Language: en-US
From: Vegard Nossum <vegard.nossum@oracle.com>
Autocrypt: addr=vegard.nossum@oracle.com; keydata=
 xsFNBE4DTU8BEADTtNncvO6rZdvTSILZHHhUnJr9Vd7N/MSx8U9z0UkAtrcgP6HPsVdsvHeU
 C6IW7L629z7CSffCXNeF8xBYnGFhCh9L9fyX/nZ2gVw/0cVDCVMwVgeXo3m8AR1iSFYvO9vC
 Rcd1fN2y+vGsJaD4JoxhKBygUtPWqUKks88NYvqyIMKgIVNQ964Qh7M+qDGY+e/BaId1OK2Z
 92jfTNE7EaIhJfHX8hW1yJKXWS54qBMqBstgLHPx8rv8AmRunsehso5nKxjtlYa/Zw5J1Uyw
 tSl+e3g/8bmCj+9+7Gj2swFlmZQwBVpVVrAR38jjEnjbKe9dQZ7c8mHHSFDflcAJlqRB2RT1
 2JA3iX/XZ0AmcOvrk62S7B4I00+kOiY6fAERPptrA19n452Non7PD5VTe2iKsOIARIkf7LvD
 q2bjzB3r41A8twtB7DUEH8Db5tbiztwy2TGLD9ga+aJJwGdy9kR5kRORNLWvqMM6Bfe9+qbw
 cJ1NXTM1RFsgCgq7U6BMEXZNcsSg9Hbs6fqDPbbZXXxn7iA4TmOhyAqgY5KCa0wm68GxMhyG
 5Q5dWfwX42/U/Zx5foyiORvEFxDBWNWc6iP1h+w8wDiiEO/UM7eH06bxRaxoMEYmcYNeEjk6
 U6qnvjUiK8A35zDOoK67t9QD35aWlNBNQ2becGk9i8fuNJKqNQARAQABzShWZWdhcmQgTm9z
 c3VtIDx2ZWdhcmQubm9zc3VtQG9yYWNsZS5jb20+wsF4BBMBAgAiBQJX+8E+AhsDBgsJCAcD
 AgYVCAIJCgsEFgIDAQIeAQIXgAAKCRALzvTY/pi6WOTDD/46kJZT/yJsYVT44e+MWvWXnzi9
 G7Tcqo1yNS5guN0d49B8ei9VvRzYpRsziaj1nAQJ8bgGJeXjNsMLMOZgx4b5OTsn8t2zIm2h
 midgIE8b3nS73uNs+9E1ktJPnHClGtTECEIIwQibpdCPYCS3lpmoAagezfcnkOqtTdgSvBg9
 FxrxKpAclgoQFTKpUoI121tvYBHmaW9K5mBM3Ty16t7IPghnndgxab+liUUZQY0TZqDG8PPW
 SuRpiVJ9buszWQvm1MUJB/MNtj1rWHivsc1Xu559PYShvJiqJF1+NCNVUx3hfXEm3evTZ9Fm
 TQJBNaeROqCToGJHjdbOdtxeSdMhaiExuSnxghqcWN+76JNXAQLlVvYhHjQwzr4me4Efo1AN
 jinz1STmmeeAMYBfHPmBNjbyNMmYBH4ETbK9XKmtkLlEPuwTXu++7zKECgsgJJJ+kvAM1OOP
 VSOKCFouq1NiuJTDwIXQf/zc1ZB8ILoY/WljE+TO/ZNmRCZl8uj03FTUzLYhR7iWdyfG5gJ/
 UfNDs/LBk596rEAtlwn0qlFUmj01B1MVeevV8JJ711S1jiRrPCXg90P3wmUUQzO0apfk1Np6
 jZVlvsnbdK/1QZaYo1kdDPEVG+TQKOgdj4wbLMBV0rh82SYM1nc6YinoXWS3EuEfRLYTf8ad
 hbkmGzrwcc7BTQROA01PARAA5+ySdsvX2RzUF6aBwtohoGYV6m2P77wn4u9uNDMD9vfcqZxj
 y9QBMKGVADLY/zoL3TJx8CYS71YNz2AsFysTdfJjNgruZW7+j2ODTrHVTNWNSpMt5yRVW426
 vN12gYjqK95c5uKNWGreP9W99T7Tj8yJe2CcoXYb6kO8hGvAHFlSYpJe+Plph5oD9llnYWpO
 XOzzuICFi4jfm0I0lvneQGd2aPK47JGHWewHn1Xk9/IwZW2InPYZat0kLlSDdiQmy/1Kv1UL
 PfzSjc9lkZqUJEXunpE0Mdp8LqowlL3rmgdoi1u4MNXurqWwPTXf1MSH537exgjqMp6tddfw
 cLAIcReIrKnN9g1+rdHfAUiHJYhEVbJACQSy9a4Z+CzUgb4RcwOQznGuzDXxnuTSuwMRxvyz
 XpDvuZazsAqB4e4p/m+42hAjE5lKBfE/p/WWewNzRRxRKvscoLcWCLg1qZ6N1pNJAh7BQdDK
 pvLaUv6zQkrlsvK2bicGXqzPVhjwX+rTghSuG3Sbsn2XdzABROgHd7ImsqzV6QQGw7eIlTD2
 MT2b9gf0f76TaTgi0kZlLpQiAGVgjNhU2Aq3xIqOFTuiGnIQN0LV9/g6KqklzOGMBYf80Pgs
 kiObHTTzSvPIT+JcdIjPcKj2+HCbgbhmrYLtGJW8Bqp/I8w2aj2nVBa7l7UAEQEAAcLBXwQY
 AQIACQUCTgNNTwIbDAAKCRALzvTY/pi6WEWzD/4rWDeWc3P0DfOv23vWgx1qboMuFLxetair
 Utae7i60PQFIVj44xG997aMjohdxxzO9oBCTxUekn31aXzTBpUbRhStq78d1hQA5Rk7nJRS6
 Nl6UtIcuLTE6Zznrq3QdQHtqwQCm1OM2F5w0ezOxbhHgt9WTrjJHact4AsN/8Aa2jmxJYrup
 aKmHqPxCVwxrrSTnx8ljisPaZWdzLQF5qmgmAqIRvX57xAuCu8O15XyZ054u73dIEYb2MBBl
 aUYwDv/4So2e2MEUymx7BF8rKDJ1LvwxKYT+X1gSdeiSambCzuEZ3SQWsVv3gn5TTCn3fHDt
 KTUL3zejji3s2V/gBXoHX7NnTNx6ZDP7It259tvWXKlUDd+spxUCF4i5fbkoQ9A0PNCwe01i
 N71y5pRS0WlFS06cvPs9lZbkAj4lDFgnOVQwmg6Smqi8gjD8rjP0GWKY24tDqd6sptX5cTDH
 pcH+LjiY61m43d8Rx+tqiUGJNUfXE/sEB+nkpL1PFWzdI1XZp4tlG6R7T9VLLf01SfeA2wgo
 9BLDRko6MK5UxPwoYDHpYiyzzAdO24dlfTphNxNcDfspLCgOW1IQ3kGoTghU7CwDtV44x4rA
 jtz7znL1XTlXp6YJQ/FWWIJfsyFvr01kTmv+/QpnAG5/iLJ+0upU1blkWmVwaEo82BU6MrS2 8A==
In-Reply-To: <3eadcc8c-d302-4a70-a16f-604285c1257d@suse.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?utf-8?B?dE5oZ25ia1RIandlVncvK3NUZUZHRUlFbW5iZTZOWTE2endGRU9hYjIvWXdN?=
 =?utf-8?B?ZGFWT2xaemRQSTh1NkYyMFVFd0daOWVpZVRMTFEwcUJkRm41QmY4U2ppU211?=
 =?utf-8?B?SkdTYmF3MFVUVUlwRDc4VUlOQWZUMnhaTURUK00zNzdDNE40QkRIb1lxWXo0?=
 =?utf-8?B?ZzJCLzYxNVROUUlmcUkvQ0VVcG5BaThLYkVwWGFtQUEwaVJwSDd4cWdiSTVU?=
 =?utf-8?B?MDJnV3FrMTB6VlpxS01HNXlQMElRSW5GMDc4VTlwQmZHOXVhbExoNWlIdXF0?=
 =?utf-8?B?UUpyNkk1NVZMUzJsK0VWNHliUTkrdXJGUTZPRHRLMUNlU0tLUjR0Y0Z6WVpC?=
 =?utf-8?B?SytLVzhScHdJWk51UGZCQ2FxbElFMEpTRUpwNmRwNkpYRTJLT29sZjRFUTB1?=
 =?utf-8?B?YTY5L3FGV2t3dXl3Y1ZKcy9SRVF3OUkvMExFbUYvVDdUQjFNVWZ0SStGbTZi?=
 =?utf-8?B?bFVKTk5sVS9sTWVXNndFb3lZdEUzbTZwWlBzSlNzcGVHdk5oSVRZV1FGU2lD?=
 =?utf-8?B?bDc5cmVUb2pLaWRCWWRBMTlHTmh1OEYwSGpYdDdEa3NudlQ4dWxtdGRwWTRS?=
 =?utf-8?B?YStvdU5YVnhHM2FjYkJtUmRJd3JvQ1U0OUExbDhBZXh6c3N4UFZPY1Q1OG1y?=
 =?utf-8?B?UmFyQVRycktaeFFaV2IzOGhNMTlxbGtFaVlydWtFNXRRVmkraVZweE9qYWtN?=
 =?utf-8?B?VmZucENhdkE0aW9OMjd4eU9lLzNNK0xuUUREaHpyd0V4b3g3ZjVNaTl1UG05?=
 =?utf-8?B?NTRZdGdvV1NrM3pYSDVzTlhmNFo1cFoxZGI1WXhpUnZVcU5oR2JQQ2RPMzky?=
 =?utf-8?B?TkVGRG9BelVYY2ZFMm1wZy83RHJRWDlZN09MZlRzMGtMWEEzM0xOdFEwZW00?=
 =?utf-8?B?eDR0Qm5GankzQncwL28rNmViSW9CaE4yaGZMdHlDZmRyek9TeFBXZVp2WFZO?=
 =?utf-8?B?aVhsZXFzNGpDNDY2SUhvdUVhQzAxV01MVi9oeHdQdkhFZmR2M01iVHY3MWN5?=
 =?utf-8?B?SVRKenk5cTZ5ZnA5SEJXV3RvUHB0QjRqdFB3eHNUM1MzVUdENDY2LytGV0N3?=
 =?utf-8?B?TGhQM1VyK2VrRlN0b1lMcXlzUzN4NzhoM0djeDY3UzZBK1RhTlFESlR0Wi9K?=
 =?utf-8?B?a1lrNko4QnZyZGpzejcrZmU0NkN6VUZYQk1EZ0xwVHlBU0xJTFh4OUoxNFhS?=
 =?utf-8?B?MTk5cUo5WXJzZmxET1RVR1VyRGpkWGd4K1EzWTZURzF0Q1dWcVlWSjlZN1ps?=
 =?utf-8?B?OGI5RDNxQmNmblhMRFdTL204Nnp0K3hvWlNsaFJSMURoSDRhZUEzT0daR3Fh?=
 =?utf-8?B?dzZabmh1KzJ4Zy9nZW9oZzlHOWVEcVRFZ3BIT3lQVVRmMnBvS1FVTkxmYTV3?=
 =?utf-8?B?aldtQ0VvakVjZTZTcUJoaGFqRm9PNXBSK0RYNUVXTllXbTFYZWJUb1lFcFdj?=
 =?utf-8?B?OSttNk1VU25WNVNKN29OSWNUM3BiU2NPcVZsaENLUFc4TlorQzcvQWhVbXh1?=
 =?utf-8?B?UWlxMWd4d2I3dm1SZmU1N3BpU3ovYytQQjFLSTBtMVpYcTRXYjNYNC90LzZK?=
 =?utf-8?B?bUhCemZYTzZBRm0za0puRTFTZlBzV0VRellvVGxqeEZNcEZ2UXAwSG1NdEti?=
 =?utf-8?B?TmdUcklkVGZ5dVNDVkxYMWdTYkdESHdUWW9pdE42ZU4yWEtMRUtRTnBUam9s?=
 =?utf-8?B?dndaTFRvZFVvUXUzTXhrdVB6YU9IbmNUYVcxY0VweGh6R1JzbVBwNlFJOHh2?=
 =?utf-8?B?dk50UXFjeVZtSHdCd1dhVU5aMVo3UGROeDZXRW5kazB3cGZGWGNHeUxBTnQ2?=
 =?utf-8?B?VVlDTTlRWmhDME9YdmJVeFRLa1JWRDVoa3QySFBaRFRPekE0SHJEWENrZFBq?=
 =?utf-8?B?MDQxSngyTzNDZUFDWEVrbUFsMmxrOGFxUnRsbWM3S3NOTUFnRlgyaEIwcUti?=
 =?utf-8?B?YUYwTmJGSlJRV21aRVNWZDRWVERWOFBsaGhFUkVYdjNCK2NLRGFvR2RkRnZ6?=
 =?utf-8?B?Q3JxV1g4VEgzZ2MraGN5OUtPUU0rMDRoelY3VGljVUY1VHJveHorMlBua29z?=
 =?utf-8?B?SXN6cVRJenNOTXFGekRwVldIUjNudVpNRm56d2hWRlcwcUVSeWY0TWs0bDFn?=
 =?utf-8?B?M1FWcEwwUGZpOXFseFRVQ3NVRFRnbmxxWjZ2dnpnOCs2d09PQ0F0OWwyQ3kr?=
 =?utf-8?B?Smc9PQ==?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	4Fhy90og/8KKeLF0xkB07mczsTGjXysRhI59DvdY/1YneD6tJPJNmAqkvHne1DZKng8qxBAdrM/p9PjMu8lavSrvKOQ9WqYZX52zNdAyXRkJ3+6AcHUegIevghczk4XwPQe3sMwiGVnl8lcbB3+sbEat/cGVwZuFyxGBwKt+EJLehPJhLYd8jA+mTLHD+e0WHbcZybDYnYFysOlnZZPVSWmwR4fMuGw4pZYwWnr+h6M4S/Mdfbn8ncOeVGCNBPF1qaDL8uzShFTjWa+bpZafCf94Nli2Dd89RMZzMvgTHB9uclzb5Z4RdMRHjHbBz349JMnDIgs7p4aJmezDJMwLn7e7gt8A/Rtu1AhfCtdi3kZ36pr7ZDmfA4b6cQ1GYGaHS9eQCocIj8JleEg4kRW/YGHvsWaNIetaOAqVffO/Q6k2y+MA+NPuHMf8tHN7smMzJVEYcsBLzqac9GrT9JptAI+MWTAC/U5BEsEKz/SL19rXtB45gL3+LzeQ9B10OIzqBpB/8SfQur69co3l5CgIOlXeDgkntuxzj+Xh0Y1S6pZDmrF6UoWLXN1+YUuJD/BJyKR2AHMiyBAEwdXSd+sciSjio57R4OPGLN15j/6RQr4=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c8d437d0-6d13-469c-64e4-08dc7b2fe7a0
X-MS-Exchange-CrossTenant-AuthSource: PH0PR10MB5433.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 May 2024 13:54:46.2302
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: fmzU+eMzb3S6nc1njil2h8O6n+lBc0bbePBaOUEmcvou1zFZ8IgtUd9SMbmvslOsCjoplRbg5q4OeEuYHPXPSqbHU6rkqZLZjuVBOoriNRI=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR10MB6447
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.650,FMLib:17.12.28.16
 definitions=2024-05-23_08,2024-05-23_01,2024-05-17_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 mlxscore=0 spamscore=0
 mlxlogscore=999 adultscore=0 bulkscore=0 suspectscore=0 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2405010000
 definitions=main-2405230096
X-Proofpoint-ORIG-GUID: _T9Szy_6FORkAKLqzJf7wLWib6Ncz08T
X-Proofpoint-GUID: _T9Szy_6FORkAKLqzJf7wLWib6Ncz08T


On 23/05/2024 12:24, Nikolay Borisov wrote:
> On 19.05.24 г. 11:34 ч., Greg Kroah-Hartman wrote:
>> Description
>> ===========
>>
>> In the Linux kernel, the following vulnerability has been resolved:
>>
>> x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()
>>
>> Modifying a MCA bank's MCA_CTL bits which control which error types to
>> be reported is done over
>>
>>    /sys/devices/system/machinecheck/
>>    ├── machinecheck0
>>    │   ├── bank0
>>    │   ├── bank1
>>    │   ├── bank10
>>    │   ├── bank11
>>    ...
>>
>> sysfs nodes by writing the new bit mask of events to enable.
>>
>> When the write is accepted, the kernel deletes all current timers and
>> reinits all banks.
>>
>> Doing that in parallel can lead to initializing a timer which is already
>> armed and in the timer wheel, i.e., in use already:
>>
>>    ODEBUG: init active (active state 0) object: ffff888063a28000 object
>>    type: timer_list hint: mce_timer_fn+0x0/0x240 
>> arch/x86/kernel/cpu/mce/core.c:2642
>>    WARNING: CPU: 0 PID: 8120 at lib/debugobjects.c:514
>>    debug_print_object+0x1a0/0x2a0 lib/debugobjects.c:514
>>
>> Fix that by grabbing the sysfs mutex as the rest of the MCA sysfs code
>> does.
>>
>> Reported by: Yue Sun <samsun1006219@gmail.com>
>> Reported by: xingwei lee <xrivendell7@gmail.com>
>>
>> The Linux kernel CVE team has assigned CVE-2024-35876 to this issue.
> 
> 
> I'd like to dispute the CVE for this issue. Those sysfs entries are 
> owned by root and can only be written by it. There are innumerable ways 
> in which root can corrupt/crash the state of the machine and I don't see 
> why this is anything special.

I haven't looked at the issue in detail but it sounds like this
potentially breaks lockdown (which is arguably a security feature) so
"requires root" to reach is not really an argument against this having a
CVE assigned.


Vegard