Medium · published September 4, 2024
In the Linux kernel, the following vulnerability has been resolved:
x86/mtrr: Check if fixed MTRRs exist before saving them
MTRRs have an obsolete fixed variant for fine grained caching control
of the 640K-1MB region that uses separate MSRs. This fixed variant has
a separate capability bit in the MTRR capability MSR.
So far all x86 CPUs which support MTRR have this separate bit set, so it
went unnoticed that mtrr_save_state() does not check the capability bit
before accessing the fixed MTRR MSRs.
Though on a CPU that does not support the fixed MTRR capability this
results in a #GP. The #GP itself is harmless because the RDMSR fault is
handled gracefully, but results in a WARN_ON().
Add the missing capability check to prevent this.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 2.6.22, < 4.19.320 | 4.19.320 |
| linux/linux_kernel | ≥ 4.20, < 5.4.282 | 5.4.282 |
| linux/linux_kernel | ≥ 5.5, < 5.10.224 | 5.10.224 |
| linux/linux_kernel | ≥ 5.11, < 5.15.165 | 5.15.165 |
| linux/linux_kernel | ≥ 5.16, < 6.1.105 | 6.1.105 |
| linux/linux_kernel | ≥ 6.2, < 6.6.46 | 6.6.46 |
| linux/linux_kernel | ≥ 6.7, < 6.10.5 | 6.10.5 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |