search

anthraxx / linux-hardened

Minimal supplement to upstream Kernel Self Protection Project changes. Features already provided by SELinux + Yama and archs other than multiarch arm64 / x86_64 aren't in scope. Only tags have stable history. Shared IRC channel with KSPP: irc.libera.chat #linux-hardening
Other
554 stars 55 forks source link

slab-out-of-bounds in ccp_rsa_crypt on AMD Zen #59

Closed MDr164 closed 3 years ago

MDr164 commented 3 years ago

Since a few releases (couldn't pinpoint which yet) I'm getting a BUG() triggered at mm/slub.c:592 (as of 5.10.17-hardened1) which seems to be caused by loading the X.509 cert. Just for testing I turned on KASAN to figure out which function seems to cause it and it points to the AMD CCP. This might be the same or a similar issue as with mem_encrypt.

Thats my current Kconfig: config-broken-ccp.txt

The Hardware this is running on is an AMD Epyc 7301 on a Supermicro H11SSL-i, no extra GPU (like observed with the mem_encrypt issue).

anthraxx commented 3 years ago

This oob certainly seems to be in vanilla. This should be reported and handled upstream, for that the easiest would be if you can try to reproduce this with KASAN and stock vanilla. Potentially you can use git bisect to pinpoint the offending commit, which would help you when you report this to the stock kernel.