{"id":"CVE-2022-49440","summary":"powerpc/rtas: Keep MSR[RI] set when calling RTAS","details":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/rtas: Keep MSR[RI] set when calling RTAS\n\nRTAS runs in real mode (MSR[DR] and MSR[IR] unset) and in 32-bit big\nendian mode (MSR[SF,LE] unset).\n\nThe change in MSR is done in enter_rtas() in a relatively complex way,\nsince the MSR value could be hardcoded.\n\nFurthermore, a panic has been reported when hitting the watchdog interrupt\nwhile running in RTAS, this leads to the following stack trace:\n\n  watchdog: CPU 24 Hard LOCKUP\n  watchdog: CPU 24 TB:997512652051031, last heartbeat TB:997504470175378 (15980ms ago)\n  ...\n  Supported: No, Unreleased kernel\n  CPU: 24 PID: 87504 Comm: drmgr Kdump: loaded Tainted: G            E  X    5.14.21-150400.71.1.bz196362_2-default #1 SLE15-SP4 (unreleased) 0d821077ef4faa8dfaf370efb5fdca1fa35f4e2c\n  NIP:  000000001fb41050 LR: 000000001fb4104c CTR: 0000000000000000\n  REGS: c00000000fc33d60 TRAP: 0100   Tainted: G            E  X     (5.14.21-150400.71.1.bz196362_2-default)\n  MSR:  8000000002981000 \u003cSF,VEC,VSX,ME\u003e  CR: 48800002  XER: 20040020\n  CFAR: 000000000000011c IRQMASK: 1\n  GPR00: 0000000000000003 ffffffffffffffff 0000000000000001 00000000000050dc\n  GPR04: 000000001ffb6100 0000000000000020 0000000000000001 000000001fb09010\n  GPR08: 0000000020000000 0000000000000000 0000000000000000 0000000000000000\n  GPR12: 80040000072a40a8 c00000000ff8b680 0000000000000007 0000000000000034\n  GPR16: 000000001fbf6e94 000000001fbf6d84 000000001fbd1db0 000000001fb3f008\n  GPR20: 000000001fb41018 ffffffffffffffff 000000000000017f fffffffffffff68f\n  GPR24: 000000001fb18fe8 000000001fb3e000 000000001fb1adc0 000000001fb1cf40\n  GPR28: 000000001fb26000 000000001fb460f0 000000001fb17f18 000000001fb17000\n  NIP [000000001fb41050] 0x1fb41050\n  LR [000000001fb4104c] 0x1fb4104c\n  Call Trace:\n  Instruction dump:\n  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n  Oops: Unrecoverable System Reset, sig: 6 [#1]\n  LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries\n  ...\n  Supported: No, Unreleased kernel\n  CPU: 24 PID: 87504 Comm: drmgr Kdump: loaded Tainted: G            E  X    5.14.21-150400.71.1.bz196362_2-default #1 SLE15-SP4 (unreleased) 0d821077ef4faa8dfaf370efb5fdca1fa35f4e2c\n  NIP:  000000001fb41050 LR: 000000001fb4104c CTR: 0000000000000000\n  REGS: c00000000fc33d60 TRAP: 0100   Tainted: G            E  X     (5.14.21-150400.71.1.bz196362_2-default)\n  MSR:  8000000002981000 \u003cSF,VEC,VSX,ME\u003e  CR: 48800002  XER: 20040020\n  CFAR: 000000000000011c IRQMASK: 1\n  GPR00: 0000000000000003 ffffffffffffffff 0000000000000001 00000000000050dc\n  GPR04: 000000001ffb6100 0000000000000020 0000000000000001 000000001fb09010\n  GPR08: 0000000020000000 0000000000000000 0000000000000000 0000000000000000\n  GPR12: 80040000072a40a8 c00000000ff8b680 0000000000000007 0000000000000034\n  GPR16: 000000001fbf6e94 000000001fbf6d84 000000001fbd1db0 000000001fb3f008\n  GPR20: 000000001fb41018 ffffffffffffffff 000000000000017f fffffffffffff68f\n  GPR24: 000000001fb18fe8 000000001fb3e000 000000001fb1adc0 000000001fb1cf40\n  GPR28: 000000001fb26000 000000001fb460f0 000000001fb17f18 000000001fb17000\n  NIP [000000001fb41050] 0x1fb41050\n  LR [000000001fb4104c] 0x1fb4104c\n  Call Trace:\n  Instruction dump:\n  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n  ---[ end trace 3ddec07f638c34a2 ]---\n\nThis happens because MSR[RI] is unset when entering RTAS but there is no\nvalid reason to not set it here.\n\nRTAS is expected to be called with MSR[RI] as specified in PAPR+ section\n\"7.2.1 Machine State\":\n\n  R1–7.2.1–9. If called with MSR[RI] equal to 1, then RTAS must protect\n  its own critical regions from recursion by setting the MSR[RI] bit to\n  0 when in the critical regions.\n\nFixing this by reviewing the way MSR is compute before calling RTAS. Now a\nhardcoded value meaning real \n---truncated---","modified":"2026-04-02T08:27:36.512152Z","published":"2025-02-26T02:12:53.988Z","related":["SUSE-SU-2025:1027-1","SUSE-SU-2025:1176-1","SUSE-SU-2025:1183-1","SUSE-SU-2025:1241-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49440.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/5ca40fcf0da0ce2b5bc44e7d8b036535955f2e3d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5f4367448f6817c8a0e94dc9736ed84fa8eee4a3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b6b1c3ce06ca438eb24e0f45bf0e63ecad0369f5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c9c41f0273826a13ac93124e66a4ff45df281ba0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49440.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49440"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"44c9f3cc1a07503b653b571eac5792436da39a30"},{"fixed":"5ca40fcf0da0ce2b5bc44e7d8b036535955f2e3d"},{"fixed":"5f4367448f6817c8a0e94dc9736ed84fa8eee4a3"},{"fixed":"c9c41f0273826a13ac93124e66a4ff45df281ba0"},{"fixed":"b6b1c3ce06ca438eb24e0f45bf0e63ecad0369f5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49440.json"}}],"schema_version":"1.7.5"}