Executive Summary

This vulnerability exists in the Linux kernel's x86 shadow stack implementation during the sigreturn process. When the kernel pops the shadow stack signal frame, it reads the shadow stack memory while holding the mmap read lock to ensure it is accessing valid shadow stack memory. However, if this read causes a page fault, the fault handler attempts to acquire the mmap read lock again, which can lead to a deadlock if another CPU is holding a write lock.

The issue arises because the kernel holds the mmap read lock during the read access, which is unsafe. The fix involves not holding the mmap lock during the read and instead using a speculative locking mechanism (mmap_lock_speculate_...) to detect changes and retry if necessary. This change requires certain kernel configuration dependencies and removes some optimizations to make the code paths more robust.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a deadlock in the Linux kernel during the sigreturn process on x86 systems using the shadow stack feature. A deadlock means that the system or affected processes could hang or become unresponsive, potentially leading to denial of service conditions.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by changes in the Linux kernel related to the handling of the shadow stack during sigreturn.

Immediate mitigation involves updating your Linux kernel to a version that includes the fix for this issue.

The fix prevents deadlock by not holding the mmap lock during the read access to userspace and instead uses mmap_lock_speculate_...() helpers to safely handle memory access.

Useful 0 Not Useful 0