CVE-2025-21632 (GCVE-0-2025-21632)
Vulnerability from cvelistv5
Published
2025-01-19 10:17
Modified
2025-05-04 07:17
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Ensure shadow stack is active before "getting" registers The x86 shadow stack support has its own set of registers. Those registers are XSAVE-managed, but they are "supervisor state components" which means that userspace can not touch them with XSAVE/XRSTOR. It also means that they are not accessible from the existing ptrace ABI for XSAVE state. Thus, there is a new ptrace get/set interface for it. The regset code that ptrace uses provides an ->active() handler in addition to the get/set ones. For shadow stack this ->active() handler verifies that shadow stack is enabled via the ARCH_SHSTK_SHSTK bit in the thread struct. The ->active() handler is checked from some call sites of the regset get/set handlers, but not the ptrace ones. This was not understood when shadow stack support was put in place. As a result, both the set/get handlers can be called with XFEATURE_CET_USER in its init state, which would cause get_xsave_addr() to return NULL and trigger a WARN_ON(). The ssp_set() handler luckily has an ssp_active() check to avoid surprising the kernel with shadow stack behavior when the kernel is not ready for it (ARCH_SHSTK_SHSTK==0). That check just happened to avoid the warning. But the ->get() side wasn't so lucky. It can be called with shadow stacks disabled, triggering the warning in practice, as reported by Christina Schimpe: WARNING: CPU: 5 PID: 1773 at arch/x86/kernel/fpu/regset.c:198 ssp_get+0x89/0xa0 [...] Call Trace: <TASK> ? show_regs+0x6e/0x80 ? ssp_get+0x89/0xa0 ? __warn+0x91/0x150 ? ssp_get+0x89/0xa0 ? report_bug+0x19d/0x1b0 ? handle_bug+0x46/0x80 ? exc_invalid_op+0x1d/0x80 ? asm_exc_invalid_op+0x1f/0x30 ? __pfx_ssp_get+0x10/0x10 ? ssp_get+0x89/0xa0 ? ssp_get+0x52/0xa0 __regset_get+0xad/0xf0 copy_regset_to_user+0x52/0xc0 ptrace_regset+0x119/0x140 ptrace_request+0x13c/0x850 ? wait_task_inactive+0x142/0x1d0 ? do_syscall_64+0x6d/0x90 arch_ptrace+0x102/0x300 [...] Ensure that shadow stacks are active in a thread before looking them up in the XSAVE buffer. Since ARCH_SHSTK_SHSTK and user_ssp[SHSTK_EN] are set at the same time, the active check ensures that there will be something to find in the XSAVE buffer. [ dhansen: changelog/subject tweaks ]
References
Impacted products
Vendor Product Version
Linux Linux Version: 2fab02b25ae7cf5f714ab456b03d9a3fe5ae98c9
Version: 2fab02b25ae7cf5f714ab456b03d9a3fe5ae98c9
Version: 2fab02b25ae7cf5f714ab456b03d9a3fe5ae98c9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/fpu/regset.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0a3a872214188e4268d31581ed0cd44508e038cf",
              "status": "affected",
              "version": "2fab02b25ae7cf5f714ab456b03d9a3fe5ae98c9",
              "versionType": "git"
            },
            {
              "lessThan": "6bfe1fc22f462bec87422cdcbec4d7a2f43ff01d",
              "status": "affected",
              "version": "2fab02b25ae7cf5f714ab456b03d9a3fe5ae98c9",
              "versionType": "git"
            },
            {
              "lessThan": "a9d9c33132d49329ada647e4514d210d15e31d81",
              "status": "affected",
              "version": "2fab02b25ae7cf5f714ab456b03d9a3fe5ae98c9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/fpu/regset.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.72",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.72",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.10",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/fpu: Ensure shadow stack is active before \"getting\" registers\n\nThe x86 shadow stack support has its own set of registers. Those registers\nare XSAVE-managed, but they are \"supervisor state components\" which means\nthat userspace can not touch them with XSAVE/XRSTOR.  It also means that\nthey are not accessible from the existing ptrace ABI for XSAVE state.\nThus, there is a new ptrace get/set interface for it.\n\nThe regset code that ptrace uses provides an -\u003eactive() handler in\naddition to the get/set ones. For shadow stack this -\u003eactive() handler\nverifies that shadow stack is enabled via the ARCH_SHSTK_SHSTK bit in the\nthread struct. The -\u003eactive() handler is checked from some call sites of\nthe regset get/set handlers, but not the ptrace ones. This was not\nunderstood when shadow stack support was put in place.\n\nAs a result, both the set/get handlers can be called with\nXFEATURE_CET_USER in its init state, which would cause get_xsave_addr() to\nreturn NULL and trigger a WARN_ON(). The ssp_set() handler luckily has an\nssp_active() check to avoid surprising the kernel with shadow stack\nbehavior when the kernel is not ready for it (ARCH_SHSTK_SHSTK==0). That\ncheck just happened to avoid the warning.\n\nBut the -\u003eget() side wasn\u0027t so lucky. It can be called with shadow stacks\ndisabled, triggering the warning in practice, as reported by Christina\nSchimpe:\n\nWARNING: CPU: 5 PID: 1773 at arch/x86/kernel/fpu/regset.c:198 ssp_get+0x89/0xa0\n[...]\nCall Trace:\n\u003cTASK\u003e\n? show_regs+0x6e/0x80\n? ssp_get+0x89/0xa0\n? __warn+0x91/0x150\n? ssp_get+0x89/0xa0\n? report_bug+0x19d/0x1b0\n? handle_bug+0x46/0x80\n? exc_invalid_op+0x1d/0x80\n? asm_exc_invalid_op+0x1f/0x30\n? __pfx_ssp_get+0x10/0x10\n? ssp_get+0x89/0xa0\n? ssp_get+0x52/0xa0\n__regset_get+0xad/0xf0\ncopy_regset_to_user+0x52/0xc0\nptrace_regset+0x119/0x140\nptrace_request+0x13c/0x850\n? wait_task_inactive+0x142/0x1d0\n? do_syscall_64+0x6d/0x90\narch_ptrace+0x102/0x300\n[...]\n\nEnsure that shadow stacks are active in a thread before looking them up\nin the XSAVE buffer. Since ARCH_SHSTK_SHSTK and user_ssp[SHSTK_EN] are\nset at the same time, the active check ensures that there will be\nsomething to find in the XSAVE buffer.\n\n[ dhansen: changelog/subject tweaks ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:17:52.848Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0a3a872214188e4268d31581ed0cd44508e038cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bfe1fc22f462bec87422cdcbec4d7a2f43ff01d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9d9c33132d49329ada647e4514d210d15e31d81"
        }
      ],
      "title": "x86/fpu: Ensure shadow stack is active before \"getting\" registers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21632",
    "datePublished": "2025-01-19T10:17:50.721Z",
    "dateReserved": "2024-12-29T08:45:45.726Z",
    "dateUpdated": "2025-05-04T07:17:52.848Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21632\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-19T11:15:08.650\",\"lastModified\":\"2025-01-19T11:15:08.650\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/fpu: Ensure shadow stack is active before \\\"getting\\\" registers\\n\\nThe x86 shadow stack support has its own set of registers. Those registers\\nare XSAVE-managed, but they are \\\"supervisor state components\\\" which means\\nthat userspace can not touch them with XSAVE/XRSTOR.  It also means that\\nthey are not accessible from the existing ptrace ABI for XSAVE state.\\nThus, there is a new ptrace get/set interface for it.\\n\\nThe regset code that ptrace uses provides an -\u003eactive() handler in\\naddition to the get/set ones. For shadow stack this -\u003eactive() handler\\nverifies that shadow stack is enabled via the ARCH_SHSTK_SHSTK bit in the\\nthread struct. The -\u003eactive() handler is checked from some call sites of\\nthe regset get/set handlers, but not the ptrace ones. This was not\\nunderstood when shadow stack support was put in place.\\n\\nAs a result, both the set/get handlers can be called with\\nXFEATURE_CET_USER in its init state, which would cause get_xsave_addr() to\\nreturn NULL and trigger a WARN_ON(). The ssp_set() handler luckily has an\\nssp_active() check to avoid surprising the kernel with shadow stack\\nbehavior when the kernel is not ready for it (ARCH_SHSTK_SHSTK==0). That\\ncheck just happened to avoid the warning.\\n\\nBut the -\u003eget() side wasn\u0027t so lucky. It can be called with shadow stacks\\ndisabled, triggering the warning in practice, as reported by Christina\\nSchimpe:\\n\\nWARNING: CPU: 5 PID: 1773 at arch/x86/kernel/fpu/regset.c:198 ssp_get+0x89/0xa0\\n[...]\\nCall Trace:\\n\u003cTASK\u003e\\n? show_regs+0x6e/0x80\\n? ssp_get+0x89/0xa0\\n? __warn+0x91/0x150\\n? ssp_get+0x89/0xa0\\n? report_bug+0x19d/0x1b0\\n? handle_bug+0x46/0x80\\n? exc_invalid_op+0x1d/0x80\\n? asm_exc_invalid_op+0x1f/0x30\\n? __pfx_ssp_get+0x10/0x10\\n? ssp_get+0x89/0xa0\\n? ssp_get+0x52/0xa0\\n__regset_get+0xad/0xf0\\ncopy_regset_to_user+0x52/0xc0\\nptrace_regset+0x119/0x140\\nptrace_request+0x13c/0x850\\n? wait_task_inactive+0x142/0x1d0\\n? do_syscall_64+0x6d/0x90\\narch_ptrace+0x102/0x300\\n[...]\\n\\nEnsure that shadow stacks are active in a thread before looking them up\\nin the XSAVE buffer. Since ARCH_SHSTK_SHSTK and user_ssp[SHSTK_EN] are\\nset at the same time, the active check ensures that there will be\\nsomething to find in the XSAVE buffer.\\n\\n[ dhansen: changelog/subject tweaks ]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: x86/fpu: Aseg\u00farese de que la pila de sombras est\u00e9 activa antes de \\\"obtener\\\" registros El soporte de la pila de sombras x86 tiene su propio conjunto de registros. Esos registros son administrados por XSAVE, pero son \\\"componentes de estado de supervisor\\\", lo que significa que el espacio de usuario no puede tocarlos con XSAVE/XRSTOR. Tambi\u00e9n significa que no son accesibles desde la ABI de ptrace existente para el estado XSAVE. Por lo tanto, hay una nueva interfaz get/set de ptrace para ello. El c\u00f3digo de conjunto de registros que usa ptrace proporciona un controlador -\u0026gt;active() adem\u00e1s de los de obtenci\u00f3n/configuraci\u00f3n. Para la pila de sombras, este controlador -\u0026gt;active() verifica que la pila de sombras est\u00e9 habilitada a trav\u00e9s del bit ARCH_SHSTK_SHSTK en la estructura del hilo. El controlador -\u0026gt;active() se verifica desde algunos sitios de llamada de los controladores get/set de conjuntos de registros, pero no de los de ptrace. Esto no se comprendi\u00f3 cuando se implement\u00f3 el soporte de la pila de sombras. Como resultado, ambos manejadores set/get pueden ser llamados con XFEATURE_CET_USER en su estado init, lo que har\u00eda que get_xsave_addr() devuelva NULL y active un WARN_ON(). El manejador ssp_set() afortunadamente tiene una verificaci\u00f3n ssp_active() para evitar sorprender al kernel con el comportamiento de la pila shadow cuando el kernel no est\u00e1 listo para ello (ARCH_SHSTK_SHSTK==0). Esa verificaci\u00f3n simplemente sucedi\u00f3 para evitar la advertencia. Pero el lado -\u0026gt;get() no tuvo tanta suerte. Puede ser llamado con las pilas shadow deshabilitadas, lo que activa la advertencia en la pr\u00e1ctica, como lo inform\u00f3 Christina Schimpe: ADVERTENCIA: CPU: 5 PID: 1773 en arch/x86/kernel/fpu/regset.c:198 ssp_get+0x89/0xa0 [...] Seguimiento de llamadas:  ? show_regs+0x6e/0x80 ? ssp_get+0x89/0xa0 ? __warn+0x91/0x150 ? ssp_get+0x89/0xa0 ? report_bug+0x19d/0x1b0 ? handle_bug+0x46/0x80 ? exc_invalid_op+0x1d/0x80 ? asm_exc_invalid_op+0x1f/0x30 ? __pfx_ssp_get+0x10/0x10 ? ssp_get+0x89/0xa0 ? ssp_get+0x52/0xa0 __regset_get+0xad/0xf0 copy_regset_to_user+0x52/0xc0 ptrace_regset+0x119/0x140 ptrace_request+0x13c/0x850 ? wait_task_inactive+0x142/0x1d0 ? do_syscall_64+0x6d/0x90 arch_ptrace+0x102/0x300 [...] Aseg\u00farese de que las pilas de sombras est\u00e9n activas en un hilo antes de buscarlas en el b\u00fafer XSAVE. Dado que ARCH_SHSTK_SHSTK y user_ssp[SHSTK_EN] se configuran al mismo tiempo, la comprobaci\u00f3n activa garantiza que habr\u00e1 algo que encontrar en el b\u00fafer XSAVE. [ dhansen: registro de cambios/asunto ajustes ]\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0a3a872214188e4268d31581ed0cd44508e038cf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6bfe1fc22f462bec87422cdcbec4d7a2f43ff01d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a9d9c33132d49329ada647e4514d210d15e31d81\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.