Public bug reported: Description: ------------
The rdmsr and wrmsr utilities from msr-tools get a segmentation fault when invoked with the -a (all processors) flag while the msr kernel module is not loaded, which means the /dev/cpu directory is not available. Looking at the upstream source code, the vulnerability lies in both rdmsr.c and wrmsr.c inside the rdmsr_on_all_cpus and wrmsr_on_all_cpus functions, respectively. The code uses the scandir() function to read the /dev/cpu directory: https://github.com/intel/msr-tools/blob/7d78c80d66463ac598bcc8bf1dc260418788dfda/rdmsr.c#L106 https://github.com/intel/msr-tools/blob/7d78c80d66463ac598bcc8bf1dc260418788dfda/wrmsr.c#L67 When /dev/cpu does not exist, scandir() returns -1 to indicate an error, and the namelist pointer remains uninitialized. However, the code does not check if dir_entries < 0. Because dir_entries is -1, it evaluates as true in the while (dir_entries--) condition, decrements to -2, and immediately attempts to access namelist[-2]->d_name. Attempting to dereference this uninitialized pointer at a negative offset causes the segmentation fault. Reproducer: ----------- In a bare metal machine (or an environment where MSR access is supported): Unload the msr module if it is currently loaded: sudo rmmod msr Verify that /dev/cpu is not available: ls -l /dev/cpu ls: cannot access '/dev/cpu': No such file or directory Run rdmsr or wrmsr querying all CPUs to trigger the segfault: sudo rdmsr -a 0xe2 Segmentation fault sudo wrmsr -a 0xe2 123 Segmentation fault Workaround: ----------- Manually load the msr kernel module before using rdmsr or wrmsr with the -a flag. Loading the module populates /dev/cpu and its child CPU nodes, preventing the scandir failure. sudo modprobe msr sudo rdmsr -a 0xe2 74008008 74008008 Additional Info: ---------------- Upstream project is in read only mode. This was tested in Jammy, Noble and Resolute. All of them have the same issue. ** Affects: msr-tools (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2163089 Title: rdmsr and wrmsr segfault when invoked with -a without the msr module loaded To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/msr-tools/+bug/2163089/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
