CVE-2024-41065 is a vulnerability identified in the Linux kernel specifically affecting the PowerPC pSeries architecture. The issue arises when reading the dispatch trace log located at /sys/kernel/debug/powerpc/dtl/cpu-* with the kernel configuration option CONFIG_HARDENED_USERCOPY enabled. This configuration is designed to harden the kernel against usercopy bugs by restricting which memory areas can be copied to userspace. However, the dispatch trace log (dtl) slab/slub object was not properly whitelisted, causing a kernel BUG() and a kernel oops (crash) when accessed. The bug trace shows the failure occurs in the usercopy_abort function, triggered by the kernel's usercopy hardening checks, which abort copying from non-whitelisted slab objects. The dispatch trace log contains hypervisor dispatch events intended for privileged users, so the fix involved marking this memory region as safe for user access by whitelisting the entire object with useroffset=0 and usersize=DISPATCH_LOG_BYTES. This prevents the kernel from crashing when privileged users read the dtl logs. The vulnerability affects Linux kernel versions using the PowerPC pSeries platform with CONFIG_HARDENED_USERCOPY enabled and kernel versions around 6.10.0-rc3. While no known exploits are reported in the wild, the issue can cause denial of service via kernel crash when privileged users attempt to read these logs. The patch involves restricting non-usercopy caches to size 0 and explicitly whitelisting the dtl slab object for usercopy operations, ensuring stability and security when accessing debug trace logs.

For European organizations running Linux on PowerPC pSeries hardware, particularly those using IBM POWER10 systems or similar, this vulnerability can lead to kernel crashes and denial of service when privileged users attempt to read dispatch trace logs. This can disrupt critical services relying on these systems, especially in sectors like finance, telecommunications, research, and government where IBM POWER systems are more prevalent. The impact is primarily on availability due to kernel panics, but could also affect system integrity if crashes occur during sensitive operations. Since the vulnerability requires privileged user access and specific kernel configuration, the attack surface is limited to internal users or administrators. However, the inability to safely access debug logs can hinder troubleshooting and incident response efforts. Organizations relying on hardened usercopy configurations for security may face operational challenges until patches are applied. The absence of known exploits reduces immediate risk, but the potential for denial of service in production environments makes timely remediation important.

1. Apply the official Linux kernel patch that whitelists the dtl slab object for usercopy operations, as referenced in commit 6d07d1cd300f, to ensure the dispatch trace log can be safely read without kernel crashes. 2. Verify that systems running PowerPC pSeries hardware with CONFIG_HARDENED_USERCOPY enabled are updated to a kernel version including this fix, ideally Linux kernel 6.10.0 or later stable releases incorporating the patch. 3. Restrict access to /sys/kernel/debug/powerpc/dtl/cpu-* files to trusted privileged users only, minimizing the risk of accidental or malicious triggering of the bug. 4. Monitor kernel logs for oops or BUG messages related to usercopy_abort or dtl_file_read to detect any attempts to exploit or encounter this issue. 5. For organizations using custom or long-term support kernels, backport the fix or consult vendor support to obtain patched kernel versions. 6. Document and train system administrators on the implications of CONFIG_HARDENED_USERCOPY and the importance of applying this patch to avoid service disruptions. 7. Consider disabling CONFIG_HARDENED_USERCOPY temporarily only if patching is not immediately possible, but be aware this reduces kernel memory copy hardening protections and may increase other risks.