CVE-2024-50072

What it actually does

The vulnerability causes a general protection fault (#GP) in the kernel when the CLEAR_CPU_BUFFERS macro executes the VERW instruction using an arbitrary user-controlled segment selector in 32-bit mode, specifically during restore_all_switch_stack when MDS/RFDS mitigations are active.

Why it matters to the business

32-bit Linux systems running legacy applications that invoke vm86 system calls may experience unexpected kernel crashes and service interruptions when CPU buffer mitigations are enabled.

How an attack unfolds

A local process triggers the restore_all_switch_stack path by executing vm86() or similar operations that leave segment registers such as %ds with arbitrary user values; the VERW instruction then faults because the effective address falls outside the segment limit, resulting in a kernel oops.

How to fix it

Upgrade the Linux kernel to a version containing commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c, which updates the CLEAR_CPU_BUFFERS macro to reference the VERW operand via the %cs selector.

How to confirm the fix worked

Confirm the fix is present in the kernel source for x86/bugs.c, rebuild, and test execution of vm86-using workloads such as dosemu on 32-bit systems to ensure no #GP occurs during context return.

Typical attack path

1. Run on 32-bit x86 kernel with MDS or RFDS mitigations enabled
2. Execute code that invokes vm86() or reaches restore_all_switch_stack with non-canonical segment selectors
3. Trigger VERW #GP fault leading to kernel panic

How to detect it

Inspect kernel logs for general protection fault entries referencing restore_all_switch_stack+0xbe/0xcf on 32-bit systems when MDS mitigations are active.

What your security team should do

• Apply the referenced kernel commit or later release on all 32-bit x86 deployments
• Review and test mitigation enablement settings for legacy 32-bit workloads
• Monitor kernel logs for general protection faults in restore_all_switch_stack