CVE-2019-13648

What it actually does

A local process on powerpc can invoke sigreturn() with a malformed signal frame, triggering a TM Bad Thing exception that crashes the kernel when hardware transactional memory is disabled.

Why it matters to the business

Unexpected system crashes on affected powerpc servers and devices cause loss of availability, interrupt workloads, and require manual restarts, increasing operational overhead on long-running systems.

How an attack unfolds

An attacker with local shell access crafts a signal frame containing invalid transactional memory state and passes it to the kernel via the sigreturn system call, forcing an unhandled exception that terminates the system.

How to fix it

Upgrade the Linux kernel to a version newer than 5.2.1 that contains the fixes for arch/powerpc/kernel/signal_32.c and signal_64.c; apply vendor-supplied patches if backported; disable unnecessary local user accounts until patched.

How to confirm the fix worked

Boot the updated kernel and confirm the signal handling paths no longer allow a crafted frame to reach the TM Bad Thing exception handler; run regression tests exercising sigreturn on powerpc with HTM disabled.

Typical attack path

1. Obtain local user access on a powerpc Linux system
2. Disable or confirm hardware transactional memory is off
3. Construct a crafted signal frame in user space
4. Invoke sigreturn() with the malicious frame
5. Trigger kernel exception leading to immediate crash

How to detect it

Search kernel logs and crash dumps for references to signal_32.c, signal_64.c, or TM Bad Thing exceptions occurring around the time of unexpected reboots; correlate with processes that recently called sigreturn.

• TM Bad Thing exception
• arch/powerpc/kernel/signal_32.c
• arch/powerpc/kernel/signal_64.c

What your security team should do

• Prioritize kernel updates on all powerpc systems within the next maintenance window
• Restrict local accounts that can execute arbitrary binaries until patches are applied
• Monitor kernel logs for TM Bad Thing exceptions as an interim detection measure