CVE-2022-49440

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/rtas: Keep MSR[RI] set when calling RTAS

RTAS runs in real mode (MSR[DR] and MSR[IR] unset) and in 32-bit big

endian mode (MSR[SF,LE] unset).

The change in MSR is done in enter_rtas() in a relatively complex way,

since the MSR value could be hardcoded.

Furthermore, a panic has been reported when hitting the watchdog interrupt

while running in RTAS, this leads to the following stack trace:

watchdog: CPU 24 Hard LOCKUP

watchdog: CPU 24 TB:997512652051031, last heartbeat TB:997504470175378 (15980ms ago)

...

Supported: No, Unreleased kernel

CPU: 24 PID: 87504 Comm: drmgr Kdump: loaded Tainted: G E X 5.14.21-150400.71.1.bz196362_2-default #1 SLE15-SP4 (unreleased) 0d821077ef4faa8dfaf370efb5fdca1fa35f4e2c

NIP: 000000001fb41050 LR: 000000001fb4104c CTR: 0000000000000000

REGS: c00000000fc33d60 TRAP: 0100 Tainted: G E X (5.14.21-150400.71.1.bz196362_2-default)

MSR:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References