Описание
In the Linux kernel, the following vulnerability has been resolved:
x86/amd_node: Avoid divide by zero on virtualized systems
On a virtualized system, the number of nodes does not have a relationship to
the number of roots. A Xen PVH dom0 can calculate roots_per_node as 0, which
crashes with a divide by zero in:
if (count++ % roots_per_node)
because the underlying topology code on Xen ends up making num_nodes
2 and num_roots 1 and the integer division result is 0.
The issue is seen with Xen, but it could affect other systems.
Set roots_per_node to 1 in this case. Print a firmware bug when this is
performed for non-virtualized systems.
[ bp: Massage commit message. ]
A flaw was found in the Linux kernel. When running in certain virtualized environments, an unexpected hardware topology reported by the hypervisor can cause the AMD node initialization logic to calculate a divisor of zero. This condition triggers an unhandled divide-by-zero error during system startup, crashing the kernel and resulting in a Denial of Service (DoS).
Отчет
A low impact divide-by-zero flaw was found in the Linux kernel's x86 AMD node initialization code. On virtualized systems the number of nodes has no relationship to the number of roots; when a hypervisor reports a topology with more nodes than roots (as seen with Xen PVH dom0, where num_nodes=2 and num_roots=1), the integer division producing roots_per_node yields 0, and the subsequent modulo operation (count++ % roots_per_node) raises an unhandled divide-by-zero exception during system startup, crashing the kernel and causing a denial of service. Red Hat rated this flaw Low impact even though the CVSS 3.1 vector reflects a high availability impact, because reliably triggering it requires control over the virtual hardware or NUMA topology, which normally belongs to a hypervisor administrator rather than an ordinary user of the affected system, and the consequence is limited to availability with no memory corruption, information disclosure, or privilege escalation. Within Red Hat's portfolio, the vulnerable code is present only in the RHEL 9.8 and later 9.z streams, the RHEL 10.2 and later 10.z streams, and products built from them (Red Hat In-Vehicle OS 2 and OpenShift Container Platform 4.22, 4.23, 5.0, and 5.1 using RHEL CoreOS 9). Earlier RHEL 6, 7, 8, and 9 releases, RHEL 10.0, and the Real Time kernel (kernel-rt) builds are not affected because the vulnerable code is not present in those kernels. Fixes for the affected streams are currently deferred given the low impact of this flaw; the residual risk is a boot-time kernel crash restricted to virtualized guests whose hypervisor exposes the atypical topology with more nodes than roots.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: x86/amd_node: Avoid divide by zero on virtualized systems On a virtualized system, the number of nodes does not have a relationship to the number of roots. A Xen PVH dom0 can calculate roots_per_node as 0, which crashes with a divide by zero in: if (count++ % roots_per_node) because the underlying topology code on Xen ends up making num_nodes 2 and num_roots 1 and the integer division result is 0. The issue is seen with Xen, but it could affect other systems. Set roots_per_node to 1 in this case. Print a firmware bug when this is performed for non-virtualized systems. [ bp: Massage commit message. ]
In the Linux kernel, the following vulnerability has been resolved: x86/amd_node: Avoid divide by zero on virtualized systems On a virtualized system, the number of nodes does not have a relationship to the number of roots. A Xen PVH dom0 can calculate roots_per_node as 0, which crashes with a divide by zero in: if (count++ % roots_per_node) because the underlying topology code on Xen ends up making num_nodes 2 and num_roots 1 and the integer division result is 0. The issue is seen with Xen, but it could affect other systems. Set roots_per_node to 1 in this case. Print a firmware bug when this is performed for non-virtualized systems. [ bp: Massage commit message. ]
In the Linux kernel, the following vulnerability has been resolved: x ...
In the Linux kernel, the following vulnerability has been resolved: x86/amd_node: Avoid divide by zero on virtualized systems On a virtualized system, the number of nodes does not have a relationship to the number of roots. A Xen PVH dom0 can calculate roots_per_node as 0, which crashes with a divide by zero in: if (count++ % roots_per_node) because the underlying topology code on Xen ends up making num_nodes 2 and num_roots 1 and the integer division result is 0. The issue is seen with Xen, but it could affect other systems. Set roots_per_node to 1 in this case. Print a firmware bug when this is performed for non-virtualized systems. [ bp: Massage commit message. ]
EPSS
5.5 Medium
CVSS3