Re: CVE-2025-21818: x86/xen: fix xen_hypercall_hvm() to not clobber %rbx

Re: CVE-2025-21818: x86/xen: fix xen_hypercall_hvm() to not clobber %rbx

[Juergen Gross]

[-- Attachment #1.1.1: Type: text/plain, Size: 888 bytes --]

On 27.02.25 21:03, Greg Kroah-Hartman wrote:
> Description
> ===========
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> x86/xen: fix xen_hypercall_hvm() to not clobber %rbx
> 
> xen_hypercall_hvm(), which is used when running as a Xen PVH guest at
> most only once during early boot, is clobbering %rbx. Depending on
> whether the caller relies on %rbx to be preserved across the call or
> not, this clobbering might result in an early crash of the system.
> 
> This can be avoided by using an already saved register instead of %rbx.
> 
> The Linux kernel CVE team has assigned CVE-2025-21818 to this issue.

Please revoke this CVE.

There is no way an unprivileged user can trigger this issue at will.
The issue is guest local and will either happen very early at boot or
it won't happen at all.

So no security issue.


Juergen

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3743 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]

Re: CVE-2025-21818: x86/xen: fix xen_hypercall_hvm() to not clobber %rbx

[Greg KH]

On Fri, Feb 28, 2025 at 08:28:48AM +0100, Juergen Gross wrote:
> On 27.02.25 21:03, Greg Kroah-Hartman wrote:
> > Description
> > ===========
> > 
> > In the Linux kernel, the following vulnerability has been resolved:
> > 
> > x86/xen: fix xen_hypercall_hvm() to not clobber %rbx
> > 
> > xen_hypercall_hvm(), which is used when running as a Xen PVH guest at
> > most only once during early boot, is clobbering %rbx. Depending on
> > whether the caller relies on %rbx to be preserved across the call or
> > not, this clobbering might result in an early crash of the system.
> > 
> > This can be avoided by using an already saved register instead of %rbx.
> > 
> > The Linux kernel CVE team has assigned CVE-2025-21818 to this issue.
> 
> Please revoke this CVE.
> 
> There is no way an unprivileged user can trigger this issue at will.
> The issue is guest local and will either happen very early at boot or
> it won't happen at all.
> 
> So no security issue.

Now rejected, thanks for the review.

greg k-h