CVE-2024-38610

2024-06-1914:15:20

416baaa9-dc9f-4396-8d5f-8c081fb06d67

web.nvd.nist.gov

linux kernel

vulnerability

acrn driver

pfnmap

pte checks

patch

follow_pte

vm_pat

x86-64

refcounted pages

memmap

contiguous

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.4%

JSON

In the Linux kernel, the following vulnerability has been resolved:

drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()

Patch series “mm: follow_pte() improvements and acrn follow_pte() fixes”.

Patch #1 fixes a bunch of issues I spotted in the acrn driver. It
compiles, that’s all I know. I’ll appreciate some review and testing from
acrn folks.

Patch #2+#3 improve follow_pte(), passing a VMA instead of the MM, adding
more sanity checks, and improving the documentation. Gave it a quick test
on x86-64 using VM_PAT that ends up using follow_pte().

This patch (of 3):

We currently miss handling various cases, resulting in a dangerous
follow_pte() (previously follow_pfn()) usage.

(1) We’re not checking PTE write permissions.

Maybe we should simply always require pte_write() like we do for
pin_user_pages_fast(FOLL_WRITE)? Hard to tell, so let’s check for
ACRN_MEM_ACCESS_WRITE for now.

(2) We’re not rejecting refcounted pages.

As we are not using MMU notifiers, messing with refcounted pages is
dangerous and can result in use-after-free. Let’s make sure to reject them.

(3) We are only looking at the first PTE of a bigger range.

We only lookup a single PTE, but memmap->len may span a larger area.
Let’s loop over all involved PTEs and make sure the PFN range is
actually contiguous. Reject everything else: it couldn’t have worked
either way, and rather made use access PFNs we shouldn’t be accessing.

Affected configurations

Vulners

Node

linuxlinux_kernelRange5.18–5.15.161

linuxlinux_kernelRange5.16.0–6.1.93

linuxlinux_kernelRange6.2.0–6.6.33

linuxlinux_kernelRange6.7.0–6.8.12

linuxlinux_kernelRange6.9.0–6.9.3

linuxlinux_kernelRange6.10.0–6.10-rc1

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/virt/acrn/mm.c"
    ],
    "versions": [
      {
        "version": "b9c43aa0b18d",
        "lessThan": "5c6705aa47b5",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8a6e85f75a83",
        "lessThan": "afeb0e696276",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8a6e85f75a83",
        "lessThan": "e873f36ec890",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8a6e85f75a83",
        "lessThan": "4c4ba3cf3a15",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8a6e85f75a83",
        "lessThan": "2c8d6e24930b",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8a6e85f75a83",
        "lessThan": "3d6586008f7b",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/virt/acrn/mm.c"
    ],
    "versions": [
      {
        "version": "5.18",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "5.18",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.15.161",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.1.93",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.6.33",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.8.12",
        "lessThanOrEqual": "6.8.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.9.3",
        "lessThanOrEqual": "6.9.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.10-rc1",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]