KASAN VMAP Stack Shadow Alignment Fault in Linux Kernel

Executive Summary

This vulnerability exists in the Linux kernel on ARM architectures. It involves the use of a word-sized load instruction (ldr) to read from the KASAN VMAP stack shadow memory in the __switch_to() function. The KASAN shadow memory is byte-granular and not guaranteed to be word aligned, but the code was using a word load which can cause alignment faults on ARMv5 processors.

Specifically, with CONFIG_KASAN_VMALLOC and CONFIG_VMAP_STACK enabled, ARM926/VersatilePB systems can crash with an alignment exception during context switching (__switch_to()). The fix changes the load instruction to a byte load (ldrb), which matches the byte granularity of the shadow memory and prevents the alignment fault.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause ARMv5-based systems running the affected Linux kernel with certain configurations (CONFIG_KASAN_VMALLOC and CONFIG_VMAP_STACK) to crash due to alignment exceptions during context switches. This can lead to system instability or denial of service on affected hardware.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is resolved by changing the dummy read from the KASAN VMAP stack shadow in the Linux kernel from a word load (ldr) to a byte load (ldrb) to avoid alignment exceptions on ARMv5 architectures.

To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix (commit 44e9a3bb76e5) which applies this change.

Useful 0 Not Useful 0