Log in Start free

Vulnerability · Published Feb 26, 2025 · Assigned by Linux

CVE-2022-49440powerpc/rtas: Keep MSR[RI] set when calling RTAS

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.3%top 82.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: Keep MSR[RI] set when calling RTAS RTAS runs in real mode (MSR[DR] and MSR[IR] unset) and in 32-bit big endian mode (MSR[SF,LE] unset). The change in MSR is done in enter_rtas() in a relatively complex way, since the MSR value could be hardcoded. Furthermore, a panic has been reported when hitting the watchdog interrupt while running in RTAS, this leads to the following stack trace: watchdog: CPU 24 Hard LOCKUP watchdog: CPU 24 TB:997512652051031, last heartbeat TB:997504470175378 (15980ms ago) ... Supported: No, Unreleased kernel CPU: 24 PID: 87504 Comm: drmgr Kdump: loaded Tainted: G E X 5.14.21-150400.71.1.bz196362_2-default #1 SLE15-SP4 (unreleased) 0d821077ef4faa8dfaf370efb5fdca1fa35f4e2c NIP: 000000001fb41050 LR: 000000001fb4104c CTR: 0000000000000000 REGS: c00000000fc33d60 TRAP: 0100 Tainted: G E X (5.14.21-150400.71.1.bz196362_2-default) MSR: 8000000002981000 <SF,VEC,VSX,ME> CR: 48800002 XER: 20040020 CFAR: 000000000000011c IRQMASK: 1 GPR00: 0000000000000003 ffffffffffffffff 0000000000000001 00000000000050dc GPR04: 000000001ffb6100 0000000000000020 0000000000000001 000000001fb09010 GPR08: 0000000020000000 0000000000000000 0000000000000000 0000000000000000 GPR12: 80040000072a40a8 c00000000ff8b680 0000000000000007 0000000000000034 GPR16: 000000001fbf6e94 000000001fbf6d84 000000001fbd1db0 000000001fb3f008 GPR20: 000000001fb41018 ffffffffffffffff 000000000000017f fffffffffffff68f GPR24: 000000001fb18fe8 000000001fb3e000 000000001fb1adc0 000000001fb1cf40 GPR28: 000000001fb26000 000000001fb460f0 000000001fb17f18 000000001fb17000 NIP [000000001fb41050] 0x1fb41050 LR [000000001fb4104c] 0x1fb4104c Call Trace: Instruction dump: XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX Oops: Unrecoverable System Reset, sig: 6 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries ... Supported: No, Unreleased kernel CPU: 24 PID: 87504 Comm: drmgr Kdump: loaded Tainted: G E X 5.14.21-150400.71.1.bz196362_2-default #1 SLE15-SP4 (unreleased) 0d821077ef4faa8dfaf370efb5fdca1fa35f4e2c NIP: 000000001fb41050 LR: 000000001fb4104c CTR: 0000000000000000 REGS: c00000000fc33d60 TRAP: 0100 Tainted: G E X (5.14.21-150400.71.1.bz196362_2-default) MSR: 8000000002981000 <SF,VEC,VSX,ME> CR: 48800002 XER: 20040020 CFAR: 000000000000011c IRQMASK: 1 GPR00: 0000000000000003 ffffffffffffffff 0000000000000001 00000000000050dc GPR04: 000000001ffb6100 0000000000000020 0000000000000001 000000001fb09010 GPR08: 0000000020000000 0000000000000000 0000000000000000 0000000000000000 GPR12: 80040000072a40a8 c00000000ff8b680 0000000000000007 0000000000000034 GPR16: 000000001fbf6e94 000000001fbf6d84 000000001fbd1db0 000000001fb3f008 GPR20: 000000001fb41018 ffffffffffffffff 000000000000017f fffffffffffff68f GPR24: 000000001fb18fe8 000000001fb3e000 000000001fb1adc0 000000001fb1cf40 GPR28: 000000001fb26000 000000001fb460f0 000000001fb17f18 000000001fb17000 NIP [000000001fb41050] 0x1fb41050 LR [000000001fb4104c] 0x1fb4104c Call Trace: Instruction dump: XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX ---[ end trace 3ddec07f638c34a2 ]--- This happens because MSR[RI] is unset when entering RTAS but there is no valid reason to not set it here. RTAS is expected to be called with MSR[RI] as specified in PAPR+ section "7.2.1 Machine State": R1–7.2.1–9. If called with MSR[RI] equal to 1, then RTAS must protect its own critical regions from recursion by setting the MSR[RI] bit to 0 when in the critical regions. Fixing this by reviewing the way MSR is compute before calling RTAS. Now a hardcoded value meaning real ---truncated---

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.18.5-1DEBIAN-CVE-2022-49440
Debian:13linux5.18.5-1DEBIAN-CVE-2022-49440
Debian:14linux5.18.5-1DEBIAN-CVE-2022-49440
Ubuntu:22.04:LTSlinux5.15.0-47.51UBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-aws5.15.0-1019.23UBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-azure5.15.0-1019.24UBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-gcp5.15.0-1017.23UBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-gke5.15.0-1015.18UBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1002.4UBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-ibm5.15.0-1013.15UBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1015.20UBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-kvm5.15.0-1017.21UBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-47.53UBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1007.7UBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-oracle5.15.0-1017.22UBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-raspi5.15.0-1014.16UBUNTU-CVE-2022-49440
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-49440
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-49440

Affected products (as reported)

VendorProductVersions
Linux Linux 44c9f3cc1a07503b653b571eac5792436da39a30 – before 5ca40fcf0da0ce2b5bc44e7d8b036535955f2e3d44c9f3cc1a07503b653b571eac5792436da39a30 – before 5f4367448f6817c8a0e94dc9736ed84fa8eee4a344c9f3cc1a07503b653b571eac5792436da39a30 – before c9c41f0273826a13ac93124e66a4ff45df281ba044c9f3cc1a07503b653b571eac5792436da39a30 – before b6b1c3ce06ca438eb24e0f45bf0e63ecad0369f5
Linux Linux 2.6.34

References