OpenRISC signal return let a local process drop memory protection
Brief
The commit calls this a local privilege escalation.
Notes
32ef1b30ad736519f7a207bcc2986f3d4129d972 (Ali Ahmet Memis, Stafford Horne). Restore only the arithmetic flags from the signal frame. Keep privileged control bits from the kernel-saved register. Fixes: ac689eb7f9d4. Cc: stable.
Landed via 5e060ff9d18748dbb21b12b821fcfc738823ba93 (openrisc for-linus).
The same path also exposed instruction-MMU, supervisor-user memory, endian, exception-prefix, and cache-enable bits. ptrace already refused SR changes.
No CVE in the commit. Do not invent one. Do not republish the PoC.
Commit 32ef1b30ad736519f7a207bcc2986f3d4129d972