CVE-2024-56761 (GCVE-0-2024-56761)

Vulnerability from cvelistv5 – Published: 2025-01-06 16:20 – Updated: 2025-05-04 10:04
VLAI?
Title
x86/fred: Clear WFE in missing-ENDBRANCH #CPs
Summary
In the Linux kernel, the following vulnerability has been resolved: x86/fred: Clear WFE in missing-ENDBRANCH #CPs An indirect branch instruction sets the CPU indirect branch tracker (IBT) into WAIT_FOR_ENDBRANCH (WFE) state and WFE stays asserted across the instruction boundary. When the decoder finds an inappropriate instruction while WFE is set ENDBR, the CPU raises a #CP fault. For the "kernel IBT no ENDBR" selftest where #CPs are deliberately triggered, the WFE state of the interrupted context needs to be cleared to let execution continue. Otherwise when the CPU resumes from the instruction that just caused the previous #CP, another missing-ENDBRANCH #CP is raised and the CPU enters a dead loop. This is not a problem with IDT because it doesn't preserve WFE and IRET doesn't set WFE. But FRED provides space on the entry stack (in an expanded CS area) to save and restore the WFE state, thus the WFE state is no longer clobbered, so software must clear it. Clear WFE to avoid dead looping in ibt_clear_fred_wfe() and the !ibt_fatal code path when execution is allowed to continue. Clobbering WFE in any other circumstance is a security-relevant bug. [ dhansen: changelog rewording ]
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: a5f6c2ace9974adf92ce65dacca8126d90adabfe , < 151447859d6fb0dcce8259f0971c6e94fb801661 (git)
Affected: a5f6c2ace9974adf92ce65dacca8126d90adabfe , < b939f108e86b76119428a6fa4e92491e09ac7867 (git)
Affected: a5f6c2ace9974adf92ce65dacca8126d90adabfe , < dc81e556f2a017d681251ace21bf06c126d5a192 (git)
Create a notification for this product.
    Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.70 , ≤ 6.6.* (semver)
Unaffected: 6.12.8 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/cet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "151447859d6fb0dcce8259f0971c6e94fb801661",
              "status": "affected",
              "version": "a5f6c2ace9974adf92ce65dacca8126d90adabfe",
              "versionType": "git"
            },
            {
              "lessThan": "b939f108e86b76119428a6fa4e92491e09ac7867",
              "status": "affected",
              "version": "a5f6c2ace9974adf92ce65dacca8126d90adabfe",
              "versionType": "git"
            },
            {
              "lessThan": "dc81e556f2a017d681251ace21bf06c126d5a192",
              "status": "affected",
              "version": "a5f6c2ace9974adf92ce65dacca8126d90adabfe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/cet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.70",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.8",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/fred: Clear WFE in missing-ENDBRANCH #CPs\n\nAn indirect branch instruction sets the CPU indirect branch tracker\n(IBT) into WAIT_FOR_ENDBRANCH (WFE) state and WFE stays asserted\nacross the instruction boundary.  When the decoder finds an\ninappropriate instruction while WFE is set ENDBR, the CPU raises a #CP\nfault.\n\nFor the \"kernel IBT no ENDBR\" selftest where #CPs are deliberately\ntriggered, the WFE state of the interrupted context needs to be\ncleared to let execution continue.  Otherwise when the CPU resumes\nfrom the instruction that just caused the previous #CP, another\nmissing-ENDBRANCH #CP is raised and the CPU enters a dead loop.\n\nThis is not a problem with IDT because it doesn\u0027t preserve WFE and\nIRET doesn\u0027t set WFE.  But FRED provides space on the entry stack\n(in an expanded CS area) to save and restore the WFE state, thus the\nWFE state is no longer clobbered, so software must clear it.\n\nClear WFE to avoid dead looping in ibt_clear_fred_wfe() and the\n!ibt_fatal code path when execution is allowed to continue.\n\nClobbering WFE in any other circumstance is a security-relevant bug.\n\n[ dhansen: changelog rewording ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T10:04:07.795Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/151447859d6fb0dcce8259f0971c6e94fb801661"
        },
        {
          "url": "https://git.kernel.org/stable/c/b939f108e86b76119428a6fa4e92491e09ac7867"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc81e556f2a017d681251ace21bf06c126d5a192"
        }
      ],
      "title": "x86/fred: Clear WFE in missing-ENDBRANCH #CPs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56761",
    "datePublished": "2025-01-06T16:20:41.112Z",
    "dateReserved": "2024-12-29T11:26:39.762Z",
    "dateUpdated": "2025-05-04T10:04:07.795Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56761\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-06T17:15:41.480\",\"lastModified\":\"2025-01-09T16:16:23.667\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/fred: Clear WFE in missing-ENDBRANCH #CPs\\n\\nAn indirect branch instruction sets the CPU indirect branch tracker\\n(IBT) into WAIT_FOR_ENDBRANCH (WFE) state and WFE stays asserted\\nacross the instruction boundary.  When the decoder finds an\\ninappropriate instruction while WFE is set ENDBR, the CPU raises a #CP\\nfault.\\n\\nFor the \\\"kernel IBT no ENDBR\\\" selftest where #CPs are deliberately\\ntriggered, the WFE state of the interrupted context needs to be\\ncleared to let execution continue.  Otherwise when the CPU resumes\\nfrom the instruction that just caused the previous #CP, another\\nmissing-ENDBRANCH #CP is raised and the CPU enters a dead loop.\\n\\nThis is not a problem with IDT because it doesn\u0027t preserve WFE and\\nIRET doesn\u0027t set WFE.  But FRED provides space on the entry stack\\n(in an expanded CS area) to save and restore the WFE state, thus the\\nWFE state is no longer clobbered, so software must clear it.\\n\\nClear WFE to avoid dead looping in ibt_clear_fred_wfe() and the\\n!ibt_fatal code path when execution is allowed to continue.\\n\\nClobbering WFE in any other circumstance is a security-relevant bug.\\n\\n[ dhansen: changelog rewording ]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/fred: Borrar WFE en #CPs de ENDBRANCH faltantes Una instrucci\u00f3n de bifurcaci\u00f3n indirecta establece el rastreador de bifurcaci\u00f3n indirecta (IBT) de la CPU en estado WAIT_FOR_ENDBRANCH (WFE) y WFE permanece afirmado a trav\u00e9s del l\u00edmite de instrucci\u00f3n. Cuando el decodificador encuentra una instrucci\u00f3n inapropiada mientras WFE est\u00e1 establecido en ENDBR, la CPU genera un error #CP. Para la autoprueba \\\"IBT del kernel sin ENDBR\\\" donde los #CP se activan deliberadamente, el estado WFE del contexto interrumpido debe borrarse para permitir que la ejecuci\u00f3n contin\u00fae. De lo contrario, cuando la CPU se reanuda desde la instrucci\u00f3n que acaba de causar el #CP anterior, se genera otro #CP de ENDBRANCH faltante y la CPU entra en un bucle muerto. Esto no es un problema con IDT porque no preserva WFE e IRET no establece WFE. Pero FRED proporciona espacio en la pila de entrada (en un \u00e1rea CS expandida) para guardar y restaurar el estado WFE, por lo que el estado WFE ya no se ve afectado, por lo que el software debe limpiarlo. Limpie WFE para evitar bucles muertos en ibt_clear_fred_wfe() y la ruta de c\u00f3digo !ibt_fatal cuando se permite que la ejecuci\u00f3n contin\u00fae. Afectar a WFE en cualquier otra circunstancia es un error relevante para la seguridad. [ dhansen: reformulaci\u00f3n del registro de cambios ]\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.12.8\",\"matchCriteriaId\":\"9603956D-3787-4C93-B9F3-D1868F726960\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/151447859d6fb0dcce8259f0971c6e94fb801661\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b939f108e86b76119428a6fa4e92491e09ac7867\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dc81e556f2a017d681251ace21bf06c126d5a192\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.