diff options
Diffstat (limited to 'meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2023-0458.patch')
| -rw-r--r-- | meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2023-0458.patch | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2023-0458.patch b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2023-0458.patch new file mode 100644 index 000000000..351debf21 --- /dev/null +++ b/meta-openbmc-mods/meta-common/recipes-kernel/linux/linux-aspeed/CVE-2023-0458.patch @@ -0,0 +1,34 @@ +From 739790605705ddcf18f21782b9c99ad7d53a8c11 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Date: Fri, 20 Jan 2023 11:03:20 +0100 +Subject: prlimit: do_prlimit needs to have a speculation check + +do_prlimit() adds the user-controlled resource value to a pointer that +will subsequently be dereferenced. In order to help prevent this +codepath from being used as a spectre "gadget" a barrier needs to be +added after checking the range. + +Reported-by: Jordy Zomer <jordyzomer@google.com> +Tested-by: Jordy Zomer <jordyzomer@google.com> +Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + kernel/sys.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/sys.c b/kernel/sys.c +index 5fd54bf0e8867..88b31f096fb2d 100644 +--- a/kernel/sys.c ++++ b/kernel/sys.c +@@ -1442,6 +1442,8 @@ static int do_prlimit(struct task_struct *tsk, unsigned int resource, + + if (resource >= RLIM_NLIMITS) + return -EINVAL; ++ resource = array_index_nospec(resource, RLIM_NLIMITS); ++ + if (new_rlim) { + if (new_rlim->rlim_cur > new_rlim->rlim_max) + return -EINVAL; +-- +cgit 1.2.3-korg + |