CVE-2025-48642 AI-generated analysis
platform/packages/modules/Virtualization, pvmfw (protected VM firmware) / vmbase, aarch64 cache maintenance
Changes pvmfw's aarch64 data-cache maintenance from "dc cvau" (clean to Point of Unification) to "dc cvac" (clean to Point of Coherency) in the exit path jump_to_payload and in the flush_region helper, so that zeroed memory that could hold secrets reaches main memory.
Root cause
In pvmfw/src/entry.rs::jump_to_payload, pvmfw zeroes .data/.bss (skipping the BCC) and the stack. It then flushes the d-cache over those regions with "dc cvau" before writing sctlr_el1 (disabling caches and the page table, per the code comment) and jumping to the payload. pvmfw/src/helpers.rs::flush_region, which flush and flushed_zeroize build on, also cleaned lines with "dc cvau". "dc cvau" only cleans to the Point of Unification. Per the commit message, some SoCs have a unified cache before the Point of Coherency, and there a clean to PoU might not flush the data to main memory. As a result, zeroing of memory that could hold secrets might not reach main memory.
How the fix works
- pvmfw/src/entry.rs::jump_to_payload: the two inline-asm loops that clean the d-cache over .data & .bss (including BCC) and over the stack region change from "0: dc cvau, {cache_line}" to "0: dc cvac, {cache_line}". Each line is now cleaned to the Point of Coherency before sctlr_el1 is rewritten and the payload is entered.
- pvmfw/src/helpers.rs::flush_region: the per-line asm!("dc cvau, {x}") becomes asm!("dc cvac, {x}"). This also changes flush() and flushed_zeroize(), which are built on top of it.
- The loop structure, the line-size computation (min_dcache_line_size from ctr_el0 DminLine) and the zeroing sequences are unchanged. Only the cache maintenance target point changes.
Completeness
- Covers every "dc cvau" instance in the two patched files: both loops in jump_to_payload and the single instruction in flush_region (and so flush/flushed_zeroize).
- On Android 14 the commit touches only pvmfw/. The commit title says "vmbase,pvmfw", and the Android 15 and 16 versions also patch a vmbase flush_region (vmbase/src/memory/util.rs on 15, libs/libvmbase/src/arch.rs on 16). The material does not show whether the Android 14 vmbase crate has its own "dc cvau" flush_region (see potential_variants).
- After the fix, the doc comments on helpers.rs::flush and flushed_zeroize still say "to the point of unification". These are stale comments with no functional effect.
- No invalidate or other cache maintenance was added; only the clean target changed.
Behavior changes
- Cache cleans in the pvmfw exit path and flush helpers now target the Point of Coherency instead of the Point of Unification. There is no API, error-code or interface change.
Per major
- Android 14: adapted fix (ed2818f8301e in android-security-14.0.0_r25): patches pvmfw/src/entry.rs::jump_to_payload (2 sites) and pvmfw/src/helpers.rs::flush_region. At android-security-14.0.0_r29 the code shows "dc cvac" at all three sites. The resolver reports 6/8 lines of the patched region present.
- Android 15: adapted fix (fa7ca326d451 in android-security-15.0.0_r13): the same two sites in pvmfw/src/entry.rs::jump_to_payload plus vmbase/src/memory/util.rs::flush_region. Resolved; 6/8 lines reported present at android-security-15.0.0_r17.
- Android 16: adapted fix (f0271f36388e in android-security-16.0.0_r4): three sites in guest/pvmfw/src/arch/aarch64/payload.rs::jump_to_payload (.data/.bss, stack, and an additional EH stack loop) plus libs/libvmbase/src/arch.rs::flush_region (crate::dc!("cvau") -> crate::dc!("cvac")). Resolved; 6/8 lines reported present at android-security-16.0.0_r8.
- Android 17: Not affected per the bulletin. The patched Android 14 files (pvmfw/src/entry.rs, pvmfw/src/helpers.rs) are absent at android-security-17.0.0_r1; the material does not show where or whether the equivalent code exists there.
Unknowns
- Which SoCs have the unified-cache-before-PoC topology; the material only references b/434562039.
- Exactly what data could be disclosed and to whom, beyond the code comment that the zeroed regions could hold secrets.
- Whether the Android 14 vmbase crate (vmbase/src/memory/util.rs) contains its own "dc cvau" flush_region at android-security-14.0.0_r25/r29; the Android 14 commit does not touch it.
- Why the resolver reports 6/8 lines of the patched region on each branch.
- The Android 17 layout of the pvmfw/vmbase code.