CVE-2024-26598 KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache

2024-02-2314:46:26

Linux

github.com

linux kernel

kvm

arm64

vgic-its

uaf

lpi translation cache

security vulnerability

refcount

AI Score

6.8

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache

There is a potential UAF scenario in the case of an LPI translation
cache hit racing with an operation that invalidates the cache, such
as a DISCARD ITS command. The root of the problem is that
vgic_its_check_cache() does not elevate the refcount on the vgic_irq
before dropping the lock that serializes refcount changes.

Have vgic_its_check_cache() raise the refcount on the returned vgic_irq
and add the corresponding decrement after queueing the interrupt.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
    ],
    "vendor": "linux",
    "product": "linux_kernel",
    "versions": [
      {
        "status": "affected",
        "version": "1da177e4c3f4",
        "lessThan": "d04acadb6490",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1da177e4c3f4",
        "lessThan": "ba7be6667408",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1da177e4c3f4",
        "lessThan": "12c2759ab134",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1da177e4c3f4",
        "lessThan": "dba788e25f05",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1da177e4c3f4",
        "lessThan": "65b201bf3e9a",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1da177e4c3f4",
        "lessThan": "dd3956a1b3dd",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1da177e4c3f4",
        "lessThan": "ad362fe07fec",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "5.4.269",
        "versionType": "custom",
        "lessThanOrEqual": "5.5"
      },
      {
        "status": "unaffected",
        "version": "5.10.209",
        "versionType": "custom",
        "lessThanOrEqual": "5.11"
      },
      {
        "status": "unaffected",
        "version": "5.15.148",
        "versionType": "custom",
        "lessThanOrEqual": "5.16"
      },
      {
        "status": "unaffected",
        "version": "6.1.75",
        "versionType": "custom",
        "lessThanOrEqual": "6.2"
      },
      {
        "status": "unaffected",
        "version": "6.6.14",
        "versionType": "custom",
        "lessThanOrEqual": "6.7"
      },
      {
        "status": "unaffected",
        "version": "6.7.2",
        "versionType": "custom",
        "lessThanOrEqual": "6.8"
      },
      {
        "status": "unaffected",
        "version": "6.8",
        "versionType": "custom",
        "lessThanOrEqual": "*"
      }
    ],
    "defaultStatus": "unknown"
  }
]