{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-38614", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-18T19:36:34.944Z", "datePublished": "2024-06-19T13:56:14.753Z", "dateUpdated": "2026-08-05T11:33:12.453Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:33:12.453Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenrisc: traps: Don't send signals to kernel mode threads\n\nOpenRISC exception handling sends signals to user processes on floating\npoint exceptions and trap instructions (for debugging) among others.\nThere is a bug where the trap handling logic may send signals to kernel\nthreads, we should not send these signals to kernel threads, if that\nhappens we treat it as an error.\n\nThis patch adds conditions to die if the kernel receives these\nexceptions in kernel mode code." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The trigger requires executing code on the target — an `rt_sigreturn` with a crafted `sigcontext.fpu.fpcsr`, a `PTRACE_SETREGSET(NT_PRFPREG)` on an own child, or an FP instruction with `FPCSR.FPEE` set. No network or adjacent-network path reaches `arch/openrisc/kernel/traps.c`.\nAC:L - The attacker fully controls the FPCSR value written to the SPR by the kernel-mode `l.mtspr` in `RESTORE_ALL`/`_switch`, so the kernel-mode exception is raised deterministically on every attempt; there is no race and no memory-layout dependence.\nPR:L - Any unprivileged local user can do this — `sigreturn` on a self-delivered signal needs no capability, and `ptrace` of one's own child needs none either; no CAP_SYS_ADMIN or root gate exists on the path into `do_fpe_trap()`/`do_trap()`.\nUI:N - The attacking process triggers the kernel-mode exception entirely on its own via a syscall return path; no other user or victim action is involved.\nS:U - The corruption and the crash are confined to the kernel of the same machine; no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - `force_sig_fault()` hands userspace a kernel text address in `si_addr` (`regs->pc` of the supervisor-mode fault), and the clobbered `EPCR`/`ESR` cause the kernel to resume in supervisor mode with attacker-controlled registers and a user-controlled `r1`, from which kernel memory can be read out.\nI:H - Because the nested kernel-mode exception overwrites `EPCR`/`ESR` mid-`RESTORE_ALL`, the subsequent `l.rfe` returns into kernel code with `SR.SM` still set and the user's register file loaded, giving a supervisor-mode stack-pivot/state-corruption primitive rather than a clean fault.\nA:H - The signal is never delivered (the kernel-mode return path skips `do_work_pending`), so the faulting `mtspr` is re-executed and the exception re-fires in an unkillable supervisor-mode loop that hangs the CPU — and on the fixed kernel the same condition is a `die()`/oops." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/openrisc/kernel/traps.c" ], "versions": [ { "version": "27267655c5313ba0f5a3caa9ad35d887d9a12574", "lessThan": "c0ed9a711e3392d73e857faa031d8d349c0d70db", "status": "affected", "versionType": "git" }, { "version": "27267655c5313ba0f5a3caa9ad35d887d9a12574", "lessThan": "075c0405b0d7d9fc490609e988a3af0069596538", "status": "affected", "versionType": "git" }, { "version": "27267655c5313ba0f5a3caa9ad35d887d9a12574", "lessThan": "cea9d0015c140af39477dd5eeb9b20233a45daa9", "status": "affected", "versionType": "git" }, { "version": "27267655c5313ba0f5a3caa9ad35d887d9a12574", "lessThan": "c88cfb5cea5f8f9868ef02cc9ce9183a26dcf20f", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/openrisc/kernel/traps.c" ], "versions": [ { "version": "6.4", "status": "affected" }, { "version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.33", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.12", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.3", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.33" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.8.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.9.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/c0ed9a711e3392d73e857faa031d8d349c0d70db" }, { "url": "https://git.kernel.org/stable/c/075c0405b0d7d9fc490609e988a3af0069596538" }, { "url": "https://git.kernel.org/stable/c/cea9d0015c140af39477dd5eeb9b20233a45daa9" }, { "url": "https://git.kernel.org/stable/c/c88cfb5cea5f8f9868ef02cc9ce9183a26dcf20f" } ], "title": "openrisc: traps: Don't send signals to kernel mode threads", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:25.973Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/c0ed9a711e3392d73e857faa031d8d349c0d70db", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/075c0405b0d7d9fc490609e988a3af0069596538", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/cea9d0015c140af39477dd5eeb9b20233a45daa9", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/c88cfb5cea5f8f9868ef02cc9ce9183a26dcf20f", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-38614", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T17:12:59.093856Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:53.276Z" } } ] } }