Borislav Petkov

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue concerns the Linux kernel, specifically with x86/CPU/AMD, where certain Zen4 client SoCs advertise the ability to use virtualized VMLOAD/VMSAVE instructions. However, using these instructions can cause a random host reboot. These instructions are not intended to be advertised on Zen4 client systems. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a bug in the x86/kexec component of the Linux kernel, where the call to `cc platform has()` triggers a fault and system crash if call depth tracking is active. This occurs because the GS segment has been reset by `load segments()` and `GS BASE` is now 0, but call depth tracking uses per-CPU variables to operate. The fix involves calling `cc platform has()` earlier in the function when GS is still valid. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The vulnerability is related to the `sys membarrier` function in the Linux kernel's `membarrier` component. It can cause a denial of service due to uncontrolled resource consumption. On some systems, `sys membarrier` can be very expensive, leading to overall slowdowns. To prevent this, a lock has been put on the path to serialize accesses and prevent the function from being called at too high a frequency. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A rare kernel panic scenario can occur due to an erratum on fast string copy instructions in the Linux kernel. This issue happens when an uncorrected error is present in the first cache line of a page, and the kernel executes page copy from the page immediately before that page. The fast string copy instructions could consume an uncorrectable memory error and raise a Machine Check Exception (MCE). This erratum is confirmed by Intel to only apply to Skylake, Cascade Lake, and Cooper Lake generations. **Recommendations** To mitigate this issue, consider disabling fast string copy by clearing bit 0 of MSR IA32 MISC ENABLE, although this may result in a permanent performance impact. Alternatively, the kernel can be modified to directly return from the MCE handler, which will prevent the kernel panic but may still result in performance degradation due to the disabling of fast string copy on the affected hyper thread. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 3.12.8 **Description** The issue is related to the `restore fpu checking` function in the Linux kernel, which does not properly clear pending exceptions before executing an EMMS instruction on AMD K7 and K8 platforms. This can be exploited by local users to cause a denial of service or potentially gain privileges through a crafted application. **Recommendations** For Linux kernel versions prior to 3.12.8, update to version 3.12.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the `restore fpu checking` function to minimize the risk of exploitation.