Skip to content

Conversation

pvts-mat
Copy link
Contributor

[LTS 9.2]
CVE-2025-21785
VULN-54130

Problem

https://www.cve.org/CVERecord?id=CVE-2025-21785

In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache levels with separate data/instructions cache. Fix this by incrementing the index for any populated leaf (instead of any populated level).

Solution

The official fix in the mainline kernel is provided in the 875d742 commit

arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array

The loop that detects/populates cache information already has a bounds
check on the array size but does not account for cache levels with
separate data/instructions cache. Fix this by incrementing the index
for any populated leaf (instead of any populated level).

The 5.15 backport (closest to ciqlts9_2 kernel version 5.14) is provided in the 88a3e6afaf002250220793df99404977d343db14 commit, and it has no differences compared to the mainline solution.

kABI check: passed

CVE=CVE-2025-21785 ./ninja.sh -d explain _kabi_checked__aarch64--test--ciqlts9_2-CVE-2025-21785

[0/1] 	Check ABI of kernel [ciqlts9_2-CVE-2025-21785]	_kabi_checked__aarch64--test--ciqlts9_2-CVE-2025-21785
++ uname -m
+ python3 /home/pvts/ctrliq-github/kernel-dist-git-el-9.2/SOURCES/check-kabi -k /home/pvts/ctrliq-github/kernel-dist-git-el-9.2/SOURCES/Module.kabi_aarch64 -s vms/aarch64--build--ciqlts9_2/build_files/kernel-src-tree-ciqlts9_2-CVE-2025-21785/Module.symvers
kABI check passed
+ touch state/kernels/ciqlts9_2-CVE-2025-21785/aarch64/kabi_checked

Boot test: passed

boot-test.log

Kselftests: passed relative

Methodology

The tests were run using the rocky-patching framework (qemu-kvm virtualization of Rocky base cloud aarch64 images) ported to the local WHLE-LS1046A machine, based on the NXP Layerscape LS1046A arm64 processor.

  • kernel-selftests-internal package: bpf tests, except bpf:test_kmod.sh, bpf:test_progs, bpf:test_progs-no_alu32 (unstable, can crash the machine).
  • source-compiled selftests: (commit f08be21) all the rest. Some collections were skipped due to problems they caused on the testing virtual machines (hangs), interfering with the testing procedure: exec, kexec, lkdtm, net/forwarding, netfilter.

Coverage

arm64/bti, arm64/fp, arm64/mte, arm64/pauth, arm64/signal, arm64/tags, bpf, breakpoints, capabilities, cgroup, clone3, core, cpu-hotplug, cpufreq, drivers/dma-buf, drivers/net/bonding, drivers/net/team, efivarfs, filesystems, filesystems/binderfs, filesystems/epoll, firmware, fpu, ftrace, futex, gpio, intel_pstate, ipc, ir, kcmp, kvm, landlock, lib, livepatch, membarrier, memfd, memory-hotplug, mincore, mount, mqueue, nci, net, net/mptcp, nsfs, openat2, pid_namespace, pidfd, proc, pstore, ptrace, rlimits, rseq, rtc, seccomp, sgx, sigaltstack, size, splice, static_keys, sync, syscall_user_dispatch, sysctl, tc-testing, tdx, timens, timers, tmpfs, tpm2, user, vDSO, vm, zram

Reference

kselftests–mix–ciqlts9_2–run1.log
kselftests–mix–ciqlts9_2–run2.log
kselftests–mix–ciqlts9_2–run3.log
kselftests–mix–ciqlts9_2–run4.log
kselftests–mix–ciqlts9_2–run5.log

Patch

kselftests–mix–ciqlts9_2-CVE-2025-21785–run1.log
kselftests–mix–ciqlts9_2-CVE-2025-21785–run2.log

Comparison

./ktests.xsh table kselftests*.log --where 'Summary = "diff"'

Column    File
--------  ---------------------------------------------------
Status0   kselftests--mix--ciqlts9_2--run1.log
Status1   kselftests--mix--ciqlts9_2--run2.log
Status2   kselftests--mix--ciqlts9_2--run3.log
Status3   kselftests--mix--ciqlts9_2--run4.log
Status4   kselftests--mix--ciqlts9_2--run5.log
Status5   kselftests--mix--ciqlts9_2-CVE-2025-21785--run1.log
Status6   kselftests--mix--ciqlts9_2-CVE-2025-21785--run2.log

TestCase              Status0  Status1  Status2  Status3  Status4  Status5  Status6  Summary
cgroup:test_freezer   pass     fail     pass     fail     pass     pass     pass     diff
net:gro.sh            fail     pass     pass     pass     pass     fail     pass     diff
proc:proc-uptime-001  pass     fail     pass     pass     pass     pass     fail     diff
timers:raw_skew       skip     skip     fail     skip     fail     fail     fail     diff

The different results are all contained in the reference run:

./ktests.xsh diff  --where 'Summary = "diff"' kselftests*ciqlts9_2--*.log

Column    File
--------  ------------------------------------
Status0   kselftests--mix--ciqlts9_2--run1.log
Status1   kselftests--mix--ciqlts9_2--run2.log
Status2   kselftests--mix--ciqlts9_2--run3.log
Status3   kselftests--mix--ciqlts9_2--run4.log
Status4   kselftests--mix--ciqlts9_2--run5.log

TestCase              Status0  Status1  Status2  Status3  Status4  Summary
cgroup:test_freezer   pass     fail     pass     fail     pass     diff
net:gro.sh            fail     pass     pass     pass     pass     diff
proc:proc-uptime-001  pass     fail     pass     pass     pass     diff
timers:raw_skew       skip     skip     fail     skip     fail     diff

Differences highlights

  1. cgroup:test_freezer

    Inconsistent results for the test_cgfreezer_ptrace.

    ./ktests.xsh show_groups kselftests--mix--ciqlts9_2--run*.log --test cgroup:test_freezer
    
    kselftests--mix--ciqlts9_2--run1.log:
    kselftests--mix--ciqlts9_2--run3.log:
    kselftests--mix--ciqlts9_2--run5.log:
    cgroup:test_freezer:
    # ok 1 test_cgfreezer_simple
    # ok 2 test_cgfreezer_tree
    # ok 3 test_cgfreezer_forkbomb
    # ok 4 test_cgfreezer_mkdir
    # ok 5 test_cgfreezer_rmdir
    # ok 6 test_cgfreezer_migrate
    # ok 7 test_cgfreezer_ptrace
    # ok 8 test_cgfreezer_stopped
    # ok 9 test_cgfreezer_ptraced
    # ok 10 test_cgfreezer_vfork
    ok 4 selftests: cgroup: test_freezer
    
    kselftests--mix--ciqlts9_2--run2.log:
    kselftests--mix--ciqlts9_2--run4.log:
    cgroup:test_freezer:
    # ok 1 test_cgfreezer_simple
    # ok 2 test_cgfreezer_tree
    # ok 3 test_cgfreezer_forkbomb
    # ok 4 test_cgfreezer_mkdir
    # ok 5 test_cgfreezer_rmdir
    # ok 6 test_cgfreezer_migrate
    # Cgroup /sys/fs/cgroup/cg_test_ptrace isn't frozen
    # not ok 7 test_cgfreezer_ptrace
    # ok 8 test_cgfreezer_stopped
    # ok 9 test_cgfreezer_ptraced
    # ok 10 test_cgfreezer_vfork
    not ok 4 selftests: cgroup: test_freezer
    
  2. net:gro.sh

    Inconsistent results for the ip6 packet geometry.

    ./ktests.xsh show kselftests--mix--ciqlts9_2--run1.log --test net:gro.sh | tail -n 20
    
    # Received {65475 899 }, Total 2 packets.
    # Expected {64576 900 900 }, Total 3 packets
    # Received {32288 [!=64576]33188 [!=900]900 }, Total 3 packets.
    # ./gro: incorrect packet geometry
    # Gro::large test passed.
    # Expected {65475 899 }, Total 2 packets
    # Received {65475 899 }, Total 2 packets.
    # Expected {64576 900 900 }, Total 3 packets
    # Received {56504 [!=64576]8972 [!=900]900 }, Total 3 packets.
    # ./gro: incorrect packet geometry
    # Gro::large test passed.
    # Expected {65475 899 }, Total 2 packets
    # Received {65475 899 }, Total 2 packets.
    # Expected {64576 900 900 }, Total 3 packets
    # Received {20180 [!=64576]45296 [!=900]900 }, Total 3 packets.
    # ./gro: incorrect packet geometry
    # Gro::large test passed.
    # failed tests: ipv6_large.     Please see log.txt for more logs
    not ok 53 selftests: net: gro.sh
    
  3. proc:proc-uptime-001

    Unspecified internal problem with the testing binary.

    ./ktests.xsh show_groups kselftests--mix--ciqlts9_2--run*.log --test proc:proc-uptime-001
    
    kselftests--mix--ciqlts9_2--run1.log:
    kselftests--mix--ciqlts9_2--run3.log:
    kselftests--mix--ciqlts9_2--run4.log:
    kselftests--mix--ciqlts9_2--run5.log:
    proc:proc-uptime-001:
    ok 11 selftests: proc: proc-uptime-001
    
    kselftests--mix--ciqlts9_2--run2.log:
    proc:proc-uptime-001:
    # proc-uptime-001: proc-uptime-001.c:39: main: Assertion `i1 >= i0' failed.
    # /usr/bin/timeout: the monitored command dumped core
    not ok 11 selftests: proc: proc-uptime-001
    
  4. timers:raw_skew

    Well-known issue with the external clock adjustments.

    ./ktests.xsh show_groups kselftests--mix--ciqlts9_2--run*.log --test timers:raw_skew
    
    kselftests--mix--ciqlts9_2--run1.log:
    timers:raw_skew:
    # Estimating clock drift: -196.453(est) 3.559(act)	[SKIP]
    # 1..0 # SKIP The clock was adjusted externally. Shutdown NTPd or other time sync daemons
    ok 7 selftests: timers: raw_skew
    
    kselftests--mix--ciqlts9_2--run2.log:
    timers:raw_skew:
    # Estimating clock drift: -196.446(est) 3.603(act)	[SKIP]
    # 1..0 # SKIP The clock was adjusted externally. Shutdown NTPd or other time sync daemons
    ok 7 selftests: timers: raw_skew
    
    kselftests--mix--ciqlts9_2--run3.log:
    timers:raw_skew:
    # Estimating clock drift: -196.397(est) 3.641(act)	[FAILED]
    # # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:0
    not ok 7 selftests: timers: raw_skew
    
    kselftests--mix--ciqlts9_2--run4.log:
    timers:raw_skew:
    # Estimating clock drift: -196.70(est) 3.934(act)	[SKIP]
    # 1..0 # SKIP The clock was adjusted externally. Shutdown NTPd or other time sync daemons
    ok 7 selftests: timers: raw_skew
    
    kselftests--mix--ciqlts9_2--run5.log:
    timers:raw_skew:
    # Estimating clock drift: -196.96(est) 3.941(act)	[FAILED]
    # # Totals: pass:0 fail:0 xfail:0 xpass:0 skip:0 error:0
    not ok 7 selftests: timers: raw_skew
    

Specific tests: skipped

To be done on demand

@pvts-mat pvts-mat changed the title arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array [LTS 9.2] arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array Apr 18, 2025
Copy link
Collaborator

@PlaidCat PlaidCat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:
Looks good thanks for working on this.

Copy link

@thefossguy-ciq thefossguy-ciq left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚤

Copy link
Collaborator

@bmastbergen bmastbergen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

jira VULN-54130
cve CVE-2025-21785
commit-author Radu Rendec <[email protected]>
commit 875d742

The loop that detects/populates cache information already has a bounds
check on the array size but does not account for cache levels with
separate data/instructions cache. Fix this by incrementing the index
for any populated leaf (instead of any populated level).

Fixes: 5d425c1 ("arm64: kernel: add support for cpu cache information")

	Signed-off-by: Radu Rendec <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
	Signed-off-by: Will Deacon <[email protected]>
(cherry picked from commit 875d742)
	Signed-off-by: Marcin Wcisło <[email protected]>
@pvts-mat pvts-mat force-pushed the ciqlts9_2-CVE-2025-21785 branch from 4cbb77e to f571a71 Compare April 22, 2025 23:51
@PlaidCat
Copy link
Collaborator

Builds completed after the rebase, merging

@PlaidCat PlaidCat merged commit 35c80df into ctrliq:ciqlts9_2 Apr 24, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

4 participants