Executive Summary

This vulnerability exists in the Linux kernel's x86 kexec functionality. When booting a second-stage kernel using kexec with a limited memory command line (e.g., "mem=<size>"), the physical memory range containing the carried-over IMA (Integrity Measurement Architecture) measurement list may lie outside the truncated RAM. This causes a kernel panic due to an invalid memory access (page fault).

The issue arises because the kernel does not properly check that the IMA kexec buffer from the previous kernel is within valid memory bounds before accessing it. Other architectures already perform this validation, but x86 did not until this fix was applied.

Without carrying the measurement list correctly across kexec, the attestation process would fail.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the system to experience a kernel panic when booting a second-stage kernel via kexec with limited memory settings. This results in a denial of service as the kernel crashes due to an invalid memory access.

Additionally, if the IMA measurement list is not properly carried over, the system's attestation mechanisms may fail, potentially impacting system integrity verification.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability manifests as a kernel panic when the second-stage kernel is booted via kexec with a limiting command line such as "mem=<size>" that causes the physical range containing the carried over IMA measurement list to fall outside the truncated RAM.

You may detect this issue by observing kernel panic logs with messages similar to:

• BUG: unable to handle page fault for address: ffff97793ff47000
• RIP: ima_restore_measurement_list+0xdc/0x45a
• #PF: error_code(0x0000) – not-present page

Since no specific detection commands are provided, monitoring kernel logs (e.g., using dmesg or journalctl) for these error messages after a kexec boot with memory limiting parameters is recommended.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by adding a sanity check on the previous kernel's IMA kexec buffer on x86 architectures, similar to checks already present on other architectures.

Immediate mitigation steps include:

• Avoid using limiting command lines such as "mem=<size>" during kexec that could truncate RAM and cause the IMA measurement list to fall outside the available memory.
• Apply the updated Linux kernel version that includes the fix for this vulnerability.
• Monitor for kernel panic messages related to this issue to detect if the vulnerability is being triggered.

Useful 0 Not Useful 0