Executive Summary

This vulnerability is a global out-of-bounds memory access in the Linux kernel's perf subsystem on x86 Intel platforms. Specifically, when running the "perf mem record" command on a non-hybrid platform like CWF, the kernel attempts to access a structure (x86_hybrid_pmu) that does not exist, causing a KASAN (Kernel Address Sanitizer) global-out-of-bounds warning. The issue arises because the code does not properly check if the platform is hybrid before accessing this structure. The fix involves adding a check (is_hybrid()) before accessing the structure to prevent the out-of-bounds access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the Linux kernel to perform an out-of-bounds memory read, which may lead to system instability, crashes, or unexpected behavior when using the perf tool on affected platforms. It could potentially be exploited to cause denial of service or other unintended effects due to improper memory access.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by running the command 'perf mem record' on the affected system. If the system is vulnerable, you will see a KASAN global-out-of-bounds warning similar to the following: BUG: KASAN: global-out-of-bounds in cmt_latency_data+0x176/0x1b0 Read of size 4 at addr ffffffffb721d000 by task dtlb/9850 This indicates the presence of the issue related to accessing the x86_hybrid_pmu structure on a non-hybrid platform.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version where the fix has been applied. The fix involves adding an is_hybrid() check before calling WARN_ON_ONCE to prevent global-out-of-bounds access. Until the update is applied, avoid running 'perf mem record' on non-hybrid platforms like CWF to prevent triggering the KASAN warning.

Useful 0 Not Useful 0