Description

In the Linux kernel, the following vulnerability has been resolved: openrisc: signal: do not restore privileged SR bits on sigreturn restore_sigcontext() copies the whole supervision register (SR) from the signal frame and only clears SPR_SR_SM before the value is reloaded into the hardware SR (through ESR and l.rfe) on the return to user space. All other SR bits are left under user control. An unprivileged task can thus return from a signal handler through a crafted sigframe that clears SPR_SR_DME. With the data MMU disabled the CPU performs no translation or protection on data accesses, so the task gains read and write access to arbitrary physical memory, a local privilege escalation. SPR_SR_IME, SPR_SR_SUMRA, SPR_SR_LEE, SPR_SR_EPH and the cache-enable bits are exposed the same way. The ptrace GPR regset already refuses any change to SR for exactly this reason. Restore only the arithmetic flag bits (F, CY, OV) from the signal frame and take every privileged control bit from the SR the kernel saved on signal entry. Verified with qemu-system-or1k -M or1k-sim: before this change an unprivileged PoC clears SPR_SR_DME in rt_sigreturn and writes a marker to physical address 0x03000000 (beyond the kernel's mem=32M); afterwards the same PoC receives SIGSEGV and physical memory is unchanged.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T15:17:10.850Z",
  "pubdate": "2026-08-26T15:17:10.850Z",
  "executiveSummary": "A critical privilege escalation vulnerability exists in the Linux kernel for the OpenRISC architecture, specifically within the signal return mechanism. The vulnerability involves improper sanitization of the Supervision Register (SR) during the execution of sigreturn.\nBy crafting a malicious signal frame, an unprivileged user-space process can manipulate the processor's privileged SR bits upon returning from a signal handler. This allows the process to disable memory protections, such as the Data MMU (DME), effectively gaining unrestricted read and write access to arbitrary physical memory addresses.\nThe flaw stems from the kernel restoring user-supplied SR values directly from the signal frame without adequate validation or restriction of sensitive control bits. This poses a significant security risk, as a local attacker can bypass kernel memory isolation and attain full system compromise. The vulnerability is exploitable by any local unprivileged process capable of triggering a signal handler, requiring no elevated privileges to initiate the attack flow.",
  "technicalDetails": "The vulnerability resides in the restore_sigcontext() function within the OpenRISC architecture's signal handling implementation. When a process returns from a signal handler via rt_sigreturn, the kernel restores the CPU state from a saved signal frame. Historically, this process involved copying the entire Supervision Register (SR) from the signal frame back into the hardware register via the Exception Supervision Register (ESR) and the l.rfe (return from exception) instruction.\nAlthough the implementation attempted to clear the SPR_SR_SM (Supervisor Mode) bit before restoration, it failed to mask other critical privileged control bits. Specifically, the register state restored from the signal frame includes control bits such as SPR_SR_DME (Data MMU Enable), SPR_SR_IME (Instruction MMU Enable), SPR_SR_SUMRA, SPR_SR_LEE (Little Endian Enable), and SPR_SR_EPH (Exception Prefix High), alongside cache configuration bits.\nThe attack flow proceeds as follows: 1) The attacker initiates a signal handler process. 2) The attacker crafts a malicious sigframe where the SR-related memory location is modified to clear the SPR_SR_DME bit. 3) Upon executing the signal return path, the kernel loads the manipulated SR value into the processor hardware. 4) With the Data MMU disabled, the processor ceases all address translation and memory protection checks. 5) The attacker's process gains direct access to arbitrary physical memory addresses, allowing it to read sensitive kernel data or overwrite kernel code and structures to facilitate privilege escalation.\nThis vulnerability highlights a critical lack of input validation in context switching code, mirroring security gaps identified in other architectures where the ptrace interface correctly restricts SR modifications. The exposure allows an attacker to operate outside the constraints of virtual memory, rendering kernel-level page protections ineffective for the duration of the compromised process's execution. Successful exploitation results in complete bypass of hardware-enforced memory isolation, enabling a local user to escalate privileges or perform arbitrary code execution at the kernel level."
}