CVE-2021-47350

What it actually does

The vulnerability causes an infinite loop of minor faults when the kernel takes an exec fault on a userspace address because is_exec_fault() returns false on PowerPC 603 hardware due to SRR1 upper bits being cleared and trap register state from prior user syscalls, preventing set_access_flags_filter() from setting PAGE_EXEC.

Why it matters to the business

Affected PowerPC systems can experience lockups or unresponsiveness during normal kernel operations involving memory faults, disrupting workloads until reboot.

How an attack unfolds

An attacker with local access triggers a kernel exec fault at a userspace address (for example via memory mappings or fault injection), the incorrect is_exec_fault() check causes the fault handler to treat it as a non-exec minor fault, set_access_flags_filter() bails without updating protections, and the page fault repeats forever instead of invoking bad_kernel_fault().

How to fix it

Update the Linux kernel to a version containing the fix that routes any kernel exec fault to bad_kernel_fault(); rebuild and reboot with the patched kernel image.

How to confirm the fix worked

Confirm the running kernel contains the commit that calls bad_kernel_fault() for kernel exec faults; reproduce an exec fault scenario and verify the system does not loop or hang.

Typical attack path

1. Obtain local code execution on a vulnerable PowerPC system
2. Trigger kernel execution path that faults on a userspace address marked non-executable
3. is_exec_fault() evaluates to false due to trap and SRR1 state
4. Fault handler loops on minor fault without setting PAGE_EXEC or killing the access

How to detect it

Review kernel logs for repeated page fault messages or watchdog timeouts on PowerPC hardware; inspect dmesg and system crash dumps for entries around fault handling in mm code.

What your security team should do

• Prioritize kernel upgrade on all PowerPC systems within standard maintenance windows
• Test patched kernels in staging environments that exercise memory fault paths
• Monitor system stability metrics on production PowerPC hosts for unexpected hangs