| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-26812: vfio/pci: Create persistent INTx handler |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| vfio/pci: Create persistent INTx handler |
| |
| A vulnerability exists where the eventfd for INTx signaling can be |
| deconfigured, which unregisters the IRQ handler but still allows |
| eventfds to be signaled with a NULL context through the SET_IRQS ioctl |
| or through unmask irqfd if the device interrupt is pending. |
| |
| Ideally this could be solved with some additional locking; the igate |
| mutex serializes the ioctl and config space accesses, and the interrupt |
| handler is unregistered relative to the trigger, but the irqfd path |
| runs asynchronous to those. The igate mutex cannot be acquired from the |
| atomic context of the eventfd wake function. Disabling the irqfd |
| relative to the eventfd registration is potentially incompatible with |
| existing userspace. |
| |
| As a result, the solution implemented here moves configuration of the |
| INTx interrupt handler to track the lifetime of the INTx context object |
| and irq_type configuration, rather than registration of a particular |
| trigger eventfd. Synchronization is added between the ioctl path and |
| eventfd_signal() wrapper such that the eventfd trigger can be |
| dynamically updated relative to in-flight interrupts or irqfd callbacks. |
| |
| The Linux kernel CVE team has assigned CVE-2024-26812 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 3.6 with commit 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 and fixed in 5.4.274 with commit b18fa894d615c8527e15d96b76c7448800e13899 |
| Issue introduced in 3.6 with commit 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 and fixed in 5.10.215 with commit 27d40bf72dd9a6600b76ad05859176ea9a1b4897 |
| Issue introduced in 3.6 with commit 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 and fixed in 5.15.154 with commit 4cb0d7532126d23145329826c38054b4e9a05e7c |
| Issue introduced in 3.6 with commit 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 and fixed in 6.1.84 with commit 7d29d4c72c1e196cce6969c98072a272d1a703b3 |
| Issue introduced in 3.6 with commit 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 and fixed in 6.6.24 with commit 69276a555c740acfbff13fb5769ee9c92e1c828e |
| Issue introduced in 3.6 with commit 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 and fixed in 6.7.12 with commit 4c089cefe30924fbe20dd1ee92774ea1f5eca834 |
| Issue introduced in 3.6 with commit 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 and fixed in 6.8.3 with commit 0e09cf81959d9f12b75ad5c6dd53d237432ed034 |
| Issue introduced in 3.6 with commit 89e1f7d4c66d85f42c3d52ea3866eb10cadf6153 and fixed in 6.9 with commit 18c198c96a815c962adc2b9b77909eec0be7df4d |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-26812 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/vfio/pci/vfio_pci_intrs.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/b18fa894d615c8527e15d96b76c7448800e13899 |
| https://git.kernel.org/stable/c/27d40bf72dd9a6600b76ad05859176ea9a1b4897 |
| https://git.kernel.org/stable/c/4cb0d7532126d23145329826c38054b4e9a05e7c |
| https://git.kernel.org/stable/c/7d29d4c72c1e196cce6969c98072a272d1a703b3 |
| https://git.kernel.org/stable/c/69276a555c740acfbff13fb5769ee9c92e1c828e |
| https://git.kernel.org/stable/c/4c089cefe30924fbe20dd1ee92774ea1f5eca834 |
| https://git.kernel.org/stable/c/0e09cf81959d9f12b75ad5c6dd53d237432ed034 |
| https://git.kernel.org/stable/c/18c198c96a815c962adc2b9b77909eec0be7df4d |
