CVE-2021-46957: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability (CVE-2021-46957) was discovered that causes a kernel panic when invoking sys_read traced by kprobe on the RISC-V architecture. The issue occurs when installing a kprobe at sys_read, which results in hitting a BUG_ON() in __find_get_block function (Kernel Git).

The vulnerability occurs through a sequence of events: 1) After installing kprobe at sys_read entry, the first instruction is replaced by 'ebreak' instruction on RISC-V platform. 2) When reaching the 'ebreak' instruction, the kernel traps into the RISC-V breakpoint handler, where it sets up single-step execution and backs up the 'sstatus' register. 3) During instruction restoration, an 'Instruction page fault' exception can occur if the page table entry isn't filled. 4) The fault handling causes the 'sstatus' CSR to be restored with a value that has interrupts disabled, leading to a kernel panic when reaching __find_get_block which requires interrupts to be enabled (Kernel Git).

When exploited, this vulnerability results in a kernel panic on RISC-V systems when using kprobes to trace the sys_read system call. This can lead to system instability and denial of service conditions (Kernel Git).

The vulnerability can be triggered using a simple reproducer that involves setting up a kprobe event on sys_read and enabling it through the kernel's tracing interface. The specific commands to reproduce are documented in the kernel commit (Kernel Git).

The issue has been fixed in the Linux kernel by restoring the value of 'sstatus' in pt_regs with the backup value when the instruction being single-stepped causes a page fault. The fix was implemented through a patch that modifies the kprobe fault handler (Kernel Git).