Heiko Carstens

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the KVM: s390: fix setting of fpc register in the Linux kernel. The `kvm arch vcpu ioctl set fpu()` function allows setting the floating point control (fpc) register of a guest CPU. The new value is tested for validity by temporarily loading it into the fpc register. However, this may lead to corruption of the fpc register of the host process if an interrupt happens while the value is temporarily loaded and floating point or vector registers are used within the interrupt context. The fix involves removing the test, which results in a change of behavior where invalid values are now accepted instead of the ioctl failing with -EINVAL. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue arises when the content of the floating point control (fpc) register of a traced process is modified with the ptrace interface. The new value is tested for validity by temporarily loading it into the fpc register. This may lead to corruption of the fpc register of the tracing process if an interrupt happens while the value is temporarily loaded into the fpc register, and within interrupt context, floating point or vector registers are used. The current fp/vx registers are saved with save fpu regs() assuming they belong to user space and will be loaded into fp/vx registers when returning to user space. However, test fp ctl() restores the original user space fpc register value, which will be discarded when returning to user space. As a result, the tracer will incorrectly continue to run with the value that was supposed to be used for the traced process. The fix involves saving fpu register contents with save fpu regs() before using test fp ctl(). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the decompressor in the Linux kernel, specifically on the s390 architecture. Historically, calls to ` decompress()` did not specify the `out len` parameter, expecting no writes beyond the uncompressed kernel image. However, with the inclusion of the zstd library commit, this behavior changed, allowing the decompression code to store literal buffers in the unwritten portion of the destination buffer. Since `out len` is not set, it is considered unlimited, which might corrupt initrd or ipl reports placed after the decompressor buffer. The size of the uncompressed kernel image is known to the decompressor, so specifying it in the `out len` parameter resolves the issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.