CVE-2024-56761

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/fred: Clear WFE in missing-ENDBRANCH #CPs

An indirect branch instruction sets the CPU indirect branch tracker

(IBT) into WAIT_FOR_ENDBRANCH (WFE) state and WFE stays asserted

across the instruction boundary. When the decoder finds an

inappropriate instruction while WFE is set ENDBR, the CPU raises a #CP

fault.

For the "kernel IBT no ENDBR" selftest where #CPs are deliberately

triggered, the WFE state of the interrupted context needs to be

cleared to let execution continue. Otherwise when the CPU resumes

from the instruction that just caused the previous #CP, another

missing-ENDBRANCH #CP is raised and the CPU enters a dead loop.

This is not a problem with IDT because it doesn't preserve WFE and

IRET doesn't set WFE. But FRED provides space on the entry stack

(in an expanded CS area) to save and restore the WFE state, thus the

WFE state is no longer clobbered, so software must clear it.

Clear WFE to avoid de

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References