CVE-2021-47428: Vulnerability in Linux Linux
In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: fix program check interrupt emergency stack path Emergency stack path was jumping into a 3: label inside the __GEN_COMMON_BODY macro for the normal path after it had finished, rather than jumping over it. By a small miracle this is the correct place to build up a new interrupt frame with the existing stack pointer, so things basically worked okay with an added weird looking 700 trap frame on top (which had the wrong ->nip so it didn't decode bug messages either). Fix this by avoiding using numeric labels when jumping over non-trivial macros. Before: LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV Modules linked in: CPU: 0 PID: 88 Comm: sh Not tainted 5.15.0-rc2-00034-ge057cdade6e5 #2637 NIP: 7265677368657265 LR: c00000000006c0c8 CTR: c0000000000097f0 REGS: c0000000fffb3a50 TRAP: 0700 Not tainted MSR: 9000000000021031 <SF,HV,ME,IR,DR,LE> CR: 00000700 XER: 20040000 CFAR: c0000000000098b0 IRQMASK: 0 GPR00: c00000000006c964 c0000000fffb3cf0 c000000001513800 0000000000000000 GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299 GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8 GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001 GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8 GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158 GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300 GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80 NIP [7265677368657265] 0x7265677368657265 LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10 Call Trace: [c0000000fffb3cf0] [c00000000000bdac] soft_nmi_common+0x13c/0x1d0 (unreliable) --- interrupt: 700 at decrementer_common_virt+0xb8/0x230 NIP: c0000000000098b8 LR: c00000000006c0c8 CTR: c0000000000097f0 REGS: c0000000fffb3d60 TRAP: 0700 Not tainted MSR: 9000000000021031 <SF,HV,ME,IR,DR,LE> CR: 22424282 XER: 20040000 CFAR: c0000000000098b0 IRQMASK: 0 GPR00: c00000000006c964 0000000000002400 c000000001513800 0000000000000000 GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299 GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8 GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001 GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8 GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158 GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300 GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80 NIP [c0000000000098b8] decrementer_common_virt+0xb8/0x230 LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10 --- interrupt: 700 Instruction dump: XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX ---[ end trace 6d28218e0cc3c949 ]--- After: ------------[ cut here ]------------ kernel BUG at arch/powerpc/kernel/exceptions-64s.S:491! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV Modules linked in: CPU: 0 PID: 88 Comm: login Not tainted 5.15.0-rc2-00034-ge057cdade6e5-dirty #2638 NIP: c0000000000098b8 LR: c00000000006bf04 CTR: c0000000000097f0 REGS: c0000000fffb3d60 TRAP: 0700 Not tainted MSR: 9000000000021031 <SF,HV,ME,IR,DR,LE> CR: 24482227 XER: 00040000 CFAR: c0000000000098b0 IRQMASK: 0 GPR00: c00000000006bf04 0000000000002400 c000000001513800 c000000001271868 GPR04: 00000000100f0d29 0000000042000000 0000000000000007 0000000000000009 GPR08: 00000000100f0d29 0000000024482227 0000000000002710 c000000000181b3c GPR12: 9000000000009033 c0000000016b0000 00000000100f0d29 c000000005b22f00 GPR16: 00000000ffff0000 0000000000000001 0000000000000009 00000000100eed90 GPR20: 00000000100eed90 00000 ---truncated---
AI Analysis
Technical Summary
CVE-2021-47428 is a vulnerability identified in the Linux kernel specifically affecting the powerpc/64s architecture. The issue stems from an incorrect jump in the emergency stack path within the __GEN_COMMON_BODY macro. Instead of jumping over a non-trivial macro section, the code erroneously jumps into a numeric label '3:', which is intended for the normal execution path. This results in the emergency interrupt stack frame being constructed incorrectly, leading to a corrupted trap frame with invalid instruction pointers (nip). The vulnerability manifests as kernel instability, including kernel BUGs and Oops exceptions during interrupt handling, particularly related to the decrementer interrupt. The root cause is a subtle programming error in assembly code that manages interrupt stack frames on PowerPC 64-bit systems with Radix MMU and SMP configurations. The fix involves avoiding the use of numeric labels for jumps over complex macros, ensuring the emergency stack path correctly bypasses the normal path code. This vulnerability does not appear to have been exploited in the wild yet and is specific to certain Linux kernel versions prior to the patch. It is a low-level kernel flaw that could cause system crashes or denial of service due to improper interrupt handling on affected hardware platforms.
Potential Impact
For European organizations using Linux systems on PowerPC 64-bit architectures, particularly those running kernels with Radix MMU and SMP configurations (such as PowerNV platforms), this vulnerability could lead to unexpected kernel panics and system crashes. This can disrupt critical services, especially in environments relying on high availability and real-time processing. Although the vulnerability does not directly enable privilege escalation or remote code execution, the resulting denial of service could impact server uptime, data processing, and operational continuity. Organizations in sectors like telecommunications, research institutions, and enterprises using specialized PowerPC hardware for compute-intensive workloads may face operational risks. The impact is limited to affected hardware and kernel versions, so the threat is not widespread across all Linux deployments. However, failure to patch could expose systems to stability issues and potential cascading failures in clustered or virtualized environments.
Mitigation Recommendations
1. Apply the official Linux kernel patch that corrects the emergency stack path jump logic as soon as it becomes available. Monitor Linux kernel mailing lists and vendor advisories for updated stable kernel releases addressing CVE-2021-47428. 2. Identify and inventory all Linux systems running on PowerPC 64-bit architectures with Radix MMU and SMP configurations, focusing on PowerNV platforms. 3. Test kernel updates in controlled environments to ensure compatibility and stability before deployment in production. 4. Implement robust monitoring of kernel logs and system health to detect early signs of kernel panics or Oops events related to interrupt handling. 5. For critical systems, consider redundancy and failover mechanisms to mitigate potential downtime caused by kernel crashes. 6. Engage with hardware and Linux distribution vendors for tailored support and backported patches if using long-term support kernels. 7. Avoid running untrusted code or workloads that could trigger interrupt storms or stress the kernel interrupt handling paths until patched.
Affected Countries
Germany, France, United Kingdom, Netherlands, Italy, Sweden
CVE-2021-47428: Vulnerability in Linux Linux
Description
In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: fix program check interrupt emergency stack path Emergency stack path was jumping into a 3: label inside the __GEN_COMMON_BODY macro for the normal path after it had finished, rather than jumping over it. By a small miracle this is the correct place to build up a new interrupt frame with the existing stack pointer, so things basically worked okay with an added weird looking 700 trap frame on top (which had the wrong ->nip so it didn't decode bug messages either). Fix this by avoiding using numeric labels when jumping over non-trivial macros. Before: LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV Modules linked in: CPU: 0 PID: 88 Comm: sh Not tainted 5.15.0-rc2-00034-ge057cdade6e5 #2637 NIP: 7265677368657265 LR: c00000000006c0c8 CTR: c0000000000097f0 REGS: c0000000fffb3a50 TRAP: 0700 Not tainted MSR: 9000000000021031 <SF,HV,ME,IR,DR,LE> CR: 00000700 XER: 20040000 CFAR: c0000000000098b0 IRQMASK: 0 GPR00: c00000000006c964 c0000000fffb3cf0 c000000001513800 0000000000000000 GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299 GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8 GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001 GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8 GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158 GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300 GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80 NIP [7265677368657265] 0x7265677368657265 LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10 Call Trace: [c0000000fffb3cf0] [c00000000000bdac] soft_nmi_common+0x13c/0x1d0 (unreliable) --- interrupt: 700 at decrementer_common_virt+0xb8/0x230 NIP: c0000000000098b8 LR: c00000000006c0c8 CTR: c0000000000097f0 REGS: c0000000fffb3d60 TRAP: 0700 Not tainted MSR: 9000000000021031 <SF,HV,ME,IR,DR,LE> CR: 22424282 XER: 20040000 CFAR: c0000000000098b0 IRQMASK: 0 GPR00: c00000000006c964 0000000000002400 c000000001513800 0000000000000000 GPR04: 0000000048ab0778 0000000042000000 0000000000000000 0000000000001299 GPR08: 000001e447c718ec 0000000022424282 0000000000002710 c00000000006bee8 GPR12: 9000000000009033 c0000000016b0000 00000000000000b0 0000000000000001 GPR16: 0000000000000000 0000000000000002 0000000000000000 0000000000000ff8 GPR20: 0000000000001fff 0000000000000007 0000000000000080 00007fff89d90158 GPR24: 0000000002000000 0000000002000000 0000000000000255 0000000000000300 GPR28: c000000001270000 0000000042000000 0000000048ab0778 c000000080647e80 NIP [c0000000000098b8] decrementer_common_virt+0xb8/0x230 LR [c00000000006c0c8] ___do_page_fault+0x3f8/0xb10 --- interrupt: 700 Instruction dump: XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX ---[ end trace 6d28218e0cc3c949 ]--- After: ------------[ cut here ]------------ kernel BUG at arch/powerpc/kernel/exceptions-64s.S:491! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV Modules linked in: CPU: 0 PID: 88 Comm: login Not tainted 5.15.0-rc2-00034-ge057cdade6e5-dirty #2638 NIP: c0000000000098b8 LR: c00000000006bf04 CTR: c0000000000097f0 REGS: c0000000fffb3d60 TRAP: 0700 Not tainted MSR: 9000000000021031 <SF,HV,ME,IR,DR,LE> CR: 24482227 XER: 00040000 CFAR: c0000000000098b0 IRQMASK: 0 GPR00: c00000000006bf04 0000000000002400 c000000001513800 c000000001271868 GPR04: 00000000100f0d29 0000000042000000 0000000000000007 0000000000000009 GPR08: 00000000100f0d29 0000000024482227 0000000000002710 c000000000181b3c GPR12: 9000000000009033 c0000000016b0000 00000000100f0d29 c000000005b22f00 GPR16: 00000000ffff0000 0000000000000001 0000000000000009 00000000100eed90 GPR20: 00000000100eed90 00000 ---truncated---
AI-Powered Analysis
Technical Analysis
CVE-2021-47428 is a vulnerability identified in the Linux kernel specifically affecting the powerpc/64s architecture. The issue stems from an incorrect jump in the emergency stack path within the __GEN_COMMON_BODY macro. Instead of jumping over a non-trivial macro section, the code erroneously jumps into a numeric label '3:', which is intended for the normal execution path. This results in the emergency interrupt stack frame being constructed incorrectly, leading to a corrupted trap frame with invalid instruction pointers (nip). The vulnerability manifests as kernel instability, including kernel BUGs and Oops exceptions during interrupt handling, particularly related to the decrementer interrupt. The root cause is a subtle programming error in assembly code that manages interrupt stack frames on PowerPC 64-bit systems with Radix MMU and SMP configurations. The fix involves avoiding the use of numeric labels for jumps over complex macros, ensuring the emergency stack path correctly bypasses the normal path code. This vulnerability does not appear to have been exploited in the wild yet and is specific to certain Linux kernel versions prior to the patch. It is a low-level kernel flaw that could cause system crashes or denial of service due to improper interrupt handling on affected hardware platforms.
Potential Impact
For European organizations using Linux systems on PowerPC 64-bit architectures, particularly those running kernels with Radix MMU and SMP configurations (such as PowerNV platforms), this vulnerability could lead to unexpected kernel panics and system crashes. This can disrupt critical services, especially in environments relying on high availability and real-time processing. Although the vulnerability does not directly enable privilege escalation or remote code execution, the resulting denial of service could impact server uptime, data processing, and operational continuity. Organizations in sectors like telecommunications, research institutions, and enterprises using specialized PowerPC hardware for compute-intensive workloads may face operational risks. The impact is limited to affected hardware and kernel versions, so the threat is not widespread across all Linux deployments. However, failure to patch could expose systems to stability issues and potential cascading failures in clustered or virtualized environments.
Mitigation Recommendations
1. Apply the official Linux kernel patch that corrects the emergency stack path jump logic as soon as it becomes available. Monitor Linux kernel mailing lists and vendor advisories for updated stable kernel releases addressing CVE-2021-47428. 2. Identify and inventory all Linux systems running on PowerPC 64-bit architectures with Radix MMU and SMP configurations, focusing on PowerNV platforms. 3. Test kernel updates in controlled environments to ensure compatibility and stability before deployment in production. 4. Implement robust monitoring of kernel logs and system health to detect early signs of kernel panics or Oops events related to interrupt handling. 5. For critical systems, consider redundancy and failover mechanisms to mitigate potential downtime caused by kernel crashes. 6. Engage with hardware and Linux distribution vendors for tailored support and backported patches if using long-term support kernels. 7. Avoid running untrusted code or workloads that could trigger interrupt storms or stress the kernel interrupt handling paths until patched.
Affected Countries
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Linux
- Date Reserved
- 2024-05-21T14:58:30.828Z
- Cisa Enriched
- true
- Cvss Version
- null
- State
- PUBLISHED
Threat ID: 682d9833c4522896dcbe9110
Added to database: 5/21/2025, 9:09:07 AM
Last enriched: 6/30/2025, 12:55:00 PM
Last updated: 8/1/2025, 9:46:33 AM
Views: 8
Actions
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.