cve/published/2024/CVE-2024-49863.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2024-49863: vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()

Since commit 3f8ca2e115e5 ("vhost/scsi: Extract common handling code
from control queue handler") a null pointer dereference bug can be
triggered when guest sends an SCSI AN request.

In vhost_scsi_ctl_handle_vq(), `vc.target` is assigned with
`&v_req.tmf.lun[1]` within a switch-case block and is then passed to
vhost_scsi_get_req() which extracts `vc->req` and `tpg`. However, for
a `VIRTIO_SCSI_T_AN_*` request, tpg is not required, so `vc.target` is
set to NULL in this branch. Later, in vhost_scsi_get_req(),
`vc->target` is dereferenced without being checked, leading to a null
pointer dereference bug. This bug can be triggered from guest.

When this bug occurs, the vhost_worker process is killed while holding
`vq->mutex` and the corresponding tpg will remain occupied
indefinitely.

Below is the KASAN report:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 PID: 840 Comm: poc Not tainted 6.10.0+ #1
Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS
1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:vhost_scsi_get_req+0x165/0x3a0
Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 2b 02 00 00
48 b8 00 00 00 00 00 fc ff df 4d 8b 65 30 4c 89 e2 48 c1 ea 03 <0f> b6
04 02 4c 89 e2 83 e2 07 38 d0 7f 08 84 c0 0f 85 be 01 00 00
RSP: 0018:ffff888017affb50 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff88801b000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888017affcb8
RBP: ffff888017affb80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff888017affc88 R14: ffff888017affd1c R15: ffff888017993000
FS:  000055556e076500(0000) GS:ffff88806b100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200027c0 CR3: 0000000010ed0004 CR4: 0000000000370ef0
Call Trace:
 <TASK>
 ? show_regs+0x86/0xa0
 ? die_addr+0x4b/0xd0
 ? exc_general_protection+0x163/0x260
 ? asm_exc_general_protection+0x27/0x30
 ? vhost_scsi_get_req+0x165/0x3a0
 vhost_scsi_ctl_handle_vq+0x2a4/0xca0
 ? __pfx_vhost_scsi_ctl_handle_vq+0x10/0x10
 ? __switch_to+0x721/0xeb0
 ? __schedule+0xda5/0x5710
 ? __kasan_check_write+0x14/0x30
 ? _raw_spin_lock+0x82/0xf0
 vhost_scsi_ctl_handle_kick+0x52/0x90
 vhost_run_work_list+0x134/0x1b0
 vhost_task_fn+0x121/0x350
...
 </TASK>
---[ end trace 0000000000000000 ]---

Let's add a check in vhost_scsi_get_req.

[whitespace fixes]

The Linux kernel CVE team has assigned CVE-2024-49863 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.20 with commit 3f8ca2e115e55af4c15d97dda635e948d2e380be and fixed in 5.10.227 with commit 6592347f06e2b19a624270a85ad4b3ae48c3b241
	Issue introduced in 4.20 with commit 3f8ca2e115e55af4c15d97dda635e948d2e380be and fixed in 5.15.168 with commit 46128370a72c431df733af5ebb065c4d48c9ad39
	Issue introduced in 4.20 with commit 3f8ca2e115e55af4c15d97dda635e948d2e380be and fixed in 6.1.113 with commit ace9c778a214da9c98d7b69d904d1b0816f4f681
	Issue introduced in 4.20 with commit 3f8ca2e115e55af4c15d97dda635e948d2e380be and fixed in 6.6.55 with commit 25613e6d9841a1f9fb985be90df921fa99f800de
	Issue introduced in 4.20 with commit 3f8ca2e115e55af4c15d97dda635e948d2e380be and fixed in 6.10.14 with commit 00fb5b23e1c9cdbe496f5cd6b40367cb895f6c93
	Issue introduced in 4.20 with commit 3f8ca2e115e55af4c15d97dda635e948d2e380be and fixed in 6.11.3 with commit 61517f33e76d2c5247c1e61e668693afe5b67e6f
	Issue introduced in 4.20 with commit 3f8ca2e115e55af4c15d97dda635e948d2e380be and fixed in 6.12 with commit 221af82f606d928ccef19a16d35633c63026f1be

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-49863
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/vhost/scsi.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6592347f06e2b19a624270a85ad4b3ae48c3b241
	https://git.kernel.org/stable/c/46128370a72c431df733af5ebb065c4d48c9ad39
	https://git.kernel.org/stable/c/ace9c778a214da9c98d7b69d904d1b0816f4f681
	https://git.kernel.org/stable/c/25613e6d9841a1f9fb985be90df921fa99f800de
	https://git.kernel.org/stable/c/00fb5b23e1c9cdbe496f5cd6b40367cb895f6c93
	https://git.kernel.org/stable/c/61517f33e76d2c5247c1e61e668693afe5b67e6f
	https://git.kernel.org/stable/c/221af82f606d928ccef19a16d35633c63026f1be