Bottlerocket: kernel-5.15: security update to 2.1.0

high Tenable Cloud Security Plugin ID 427919

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: ARM: 9381/1: kasan: clear stale stack
poison We found below OOB crash: [ 33.452494]
================================================================== [ 33.453513] BUG: KASAN: stack-out-of-
bounds in refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec [ 33.454660] Write of size 164 at addr c1d03d30 by
task swapper/0/0 [ 33.455515] [ 33.455767] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O 6.1.25-mainline #1 [
33.456880] Hardware name: Generic DT based system [ 33.457555] unwind_backtrace from show_stack+0x18/0x1c
[ 33.458326] show_stack from dump_stack_lvl+0x40/0x4c [ 33.459072] dump_stack_lvl from
print_report+0x158/0x4a4 [ 33.459863] print_report from kasan_report+0x9c/0x148 [ 33.460616] kasan_report
from kasan_check_range+0x94/0x1a0 [ 33.461424] kasan_check_range from memset+0x20/0x3c [ 33.462157] memset
from refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec [ 33.463064] refresh_cpu_vm_stats.constprop.0 from
tick_nohz_idle_stop_tick+0x180/0x53c [ 33.464181] tick_nohz_idle_stop_tick from do_idle+0x264/0x354 [
33.465029] do_idle from cpu_startup_entry+0x20/0x24 [ 33.465769] cpu_startup_entry from
rest_init+0xf0/0xf4 [ 33.466528] rest_init from arch_post_acpi_subsys_init+0x0/0x18 [ 33.467397] [
33.467644] The buggy address belongs to stack of task swapper/0/0 [ 33.468493] and is located at offset
112 in frame: [ 33.469172] refresh_cpu_vm_stats.constprop.0+0x0/0x2ec [ 33.469917] [ 33.470165] This frame
has 2 objects: [ 33.470696] [32, 76) 'global_zone_diff' [ 33.470729] [112, 276) 'global_node_diff' [
33.471294] [ 33.472095] The buggy address belongs to the physical page: [ 33.472862] page:3cd72da8
refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x41d03 [ 33.473944] flags: 0x1000(reserved|zone=0) [
33.474565] raw: 00001000 ed741470 ed741470 00000000 00000000 00000000 ffffffff 00000001 [ 33.475656] raw:
00000000 [ 33.476050] page dumped because: kasan: bad access detected [ 33.476816] [ 33.477061] Memory
state around the buggy address: [ 33.477732] c1d03c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [
33.478630] c1d03c80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 [ 33.479526] >c1d03d00: 00 04 f2 f2
f2 f2 00 00 00 00 00 00 f1 f1 f1 f1 [ 33.480415] ^ [ 33.481195] c1d03d80: 00 00 00 00 00 00 00 00 00 00 04
f3 f3 f3 f3 f3 [ 33.482088] c1d03e00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.482978]
================================================================== We find the root cause of this OOB is
that arm does not clear stale stack poison in the case of cpuidle. This patch refer to
arch/arm64/kernel/sleep.S to resolve this issue. From cited commit [1] that explain the problem Functions
which the compiler has instrumented for KASAN place poison on the stack shadow upon entry and remove this
poison prior to returning. In the case of cpuidle, CPUs exit the kernel a number of levels deep in C code.
Any instrumented functions on this critical path will leave portions of the stack shadow poisoned. If CPUs
lose context and return to the kernel via a cold path, we restore a prior context saved in
__cpu_suspend_enter are forgotten, and we never remove the poison they placed in the stack shadow area by
functions calls between this and the actual exit of the kernel. Thus, (depending on stackframe layout)
subsequent calls to instrumented functions may hit this stale poison, resulting in (spurious) KASAN splats
to the console. To avoid this, clear any stale poison from the idle thread for a CPU prior to bringing a
CPU online. From cited commit [2] Extend to check for CONFIG_KASAN_STACK [1] commit 0d97e6d8024c ("arm64:
kasan: clear stale stack poison") [2] commit d56a9ef84bd0 ("kasan, arm64: unpoison stack only with
CONFIG_KASAN_STACK") (CVE-2024-36906)

Plugin Details

Severity: High

ID: 427919

Version: Revision 1.8

Type: Local

Family: Bottlerocket Local Security Checks

Published: 6/30/2025

Updated: 6/22/2026

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2024-36906

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 5/30/2024

Reference Information

CVE: CVE-2024-36906

Detections

Analytics