CVE-2024-50072

x86/bugs: Use code segment selector for VERW operand

State: Published
Severity: Not scored
Published: Oct 29, 2024
Updated: May 23, 2026
Reserved: Oct 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

x86/bugs: Use code segment selector for VERW operand

Robert Gill reported below #GP in 32-bit mode when dosemu software was executing vm86() system call:

general protection fault: 0000 [#1] PREEMPT SMP CPU: 4 PID: 4610 Comm: dosemu.bin Not tainted 6.6.21-gentoo-x86 #1 Hardware name: Dell Inc. PowerEdge 1950/0H723K, BIOS 2.7.0 10/30/2010 EIP: restore_all_switch_stack+0xbe/0xcf EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: 00000000 ESI: 00000000 EDI: 00000000 EBP: 00000000 ESP: ff8affdc DS: 0000 ES: 0000 FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010046 CR0: 80050033 CR2: 00c2101c CR3: 04b6d000 CR4: 000406d0 Call Trace: show_regs+0x70/0x78 die_addr+0x29/0x70 exc_general_protection+0x13c/0x348 exc_bounds+0x98/0x98 handle_exception+0x14d/0x14d exc_bounds+0x98/0x98 restore_all_switch_stack+0xbe/0xcf exc_bounds+0x98/0x98 restore_all_switch_stack+0xbe/0xcf

This only happens in 32-bit mode when VERW based mitigations like MDS/RFDS are enabled. This is because segment registers with an arbitrary user value can result in #GP when executing VERW. Intel SDM vol. 2C documents the following behavior for VERW instruction:

#GP(0) - If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.

CLEAR_CPU_BUFFERS macro executes VERW instruction before returning to user space. Use %cs selector to reference VERW operand. This ensures VERW will not #GP for an arbitrary user %ds.

[ mingo: Fixed the SOB chain. ]

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	50f021f0b985629accf10481a6e89af8b9700583 to before bfd1d223d80cb29a210caa1bd5e21f0816d58f02Affected d54de9f2a127090f2017184e8257795b487d5312 to before ada431c6c31a2c8c37991c46089af5caa23a9c6eAffected 2e3087505ddb8ba2d3d4c81306cca11e868fcdb9 to before 38c5fe74f3bef98f75d16effa49836d50c9b6097Affected ca13d8cd8dac25558da4ee8df4dc70e8e7f9d762 to before 481b477ab63c7245715a3e57ba79eb87c2dc0d02Affected a0e2dab44d22b913b4c228c8b52b2a104434b0b3 to before bc576fbaf82deded606e69a00efe9752136bf91dAffected a0e2dab44d22b913b4c228c8b52b2a104434b0b3 to before e4d2102018542e3ae5e297bc6e229303abff8a0fAffected 51eca9f1fd047b500137d021f882d93f03280118Affected 5.10.215 to before 5.10.229Affected 5.15.154 to before 5.15.171Affected 6.1.81 to before 6.1.116Affected 6.6.21 to before 6.6.58Affected 6.7.9 to before 6.8Affected
LinuxLinux	6.8Affected before 6.8Not affected 5.10.229 through 5.10.Not affected 5.15.171 through 5.15.Not affected 6.1.116 through 6.1.Not affected 6.6.58 through 6.6.Not affected 6.11.5 through 6.11.*Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

50f021f0b985629accf10481a6e89af8b9700583 to before bfd1d223d80cb29a210caa1bd5e21f0816d58f02Affected
d54de9f2a127090f2017184e8257795b487d5312 to before ada431c6c31a2c8c37991c46089af5caa23a9c6eAffected
2e3087505ddb8ba2d3d4c81306cca11e868fcdb9 to before 38c5fe74f3bef98f75d16effa49836d50c9b6097Affected
ca13d8cd8dac25558da4ee8df4dc70e8e7f9d762 to before 481b477ab63c7245715a3e57ba79eb87c2dc0d02Affected
a0e2dab44d22b913b4c228c8b52b2a104434b0b3 to before bc576fbaf82deded606e69a00efe9752136bf91dAffected
a0e2dab44d22b913b4c228c8b52b2a104434b0b3 to before e4d2102018542e3ae5e297bc6e229303abff8a0fAffected
51eca9f1fd047b500137d021f882d93f03280118Affected
5.10.215 to before 5.10.229Affected
5.15.154 to before 5.15.171Affected
6.1.81 to before 6.1.116Affected
6.6.21 to before 6.6.58Affected
6.7.9 to before 6.8Affected

LinuxLinux

6.8Affected
before 6.8Not affected
5.10.229 through 5.10.*Not affected
5.15.171 through 5.15.*Not affected
6.1.116 through 6.1.*Not affected
6.6.58 through 6.6.*Not affected
6.11.5 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.