CVE-2024-42230

powerpc/pseries: Fix scv instruction crash with kexec

Description

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix scv instruction crash with kexec kexec on pseries disables AIL (reloc_on_exc), required for scv instruction support, before other CPUs have been shut down. This means they can execute scv instructions after AIL is disabled, which causes an interrupt at an unexpected entry location that crashes the kernel. Change the kexec sequence to disable AIL after other CPUs have been brought down. As a refresher, the real-mode scv interrupt vector is 0x17000, and the fixed-location head code probably couldn't easily deal with implementing such high addresses so it was just decided not to support that interrupt at all.

4.4

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 0.04%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/c550679d604798d9fed8a5b2bb5693448a25407c	patch
https://git.kernel.org/stable/c/d10e3c39001e9194b9a1bfd6979bd3fa19dccdc5	patch
https://git.kernel.org/stable/c/8c6506616386ce37e59b2745fc481c6713fae4f3	patch
https://git.kernel.org/stable/c/21a741eb75f80397e5f7d3739e24d7d75e619011	patch

Frequently Asked Questions

What is the severity of CVE-2024-42230?: CVE-2024-42230 has been scored as a medium severity vulnerability.
How to fix CVE-2024-42230?: To fix CVE-2024-42230, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-42230 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-42230 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-42230?: CVE-2024-42230 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.