| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() |
| |
| Explicitly verify the target vCPU is fully online _prior_ to clamping the |
| index in kvm_get_vcpu(). If the index is "bad", the nospec clamping will |
| generate '0', i.e. KVM will return vCPU0 instead of NULL. |
| |
| In practice, the bug is unlikely to cause problems, as it will only come |
| into play if userspace or the guest is buggy or misbehaving, e.g. KVM may |
| send interrupts to vCPU0 instead of dropping them on the floor. |
| |
| However, returning vCPU0 when it shouldn't exist per online_vcpus is |
| problematic now that KVM uses an xarray for the vCPUs array, as KVM needs |
| to insert into the xarray before publishing the vCPU to userspace (see |
| commit c5b077549136 ("KVM: Convert the kvm->vcpus array to a xarray")), |
| i.e. before vCPU creation is guaranteed to succeed. |
| |
| As a result, incorrectly providing access to vCPU0 will trigger a |
| use-after-free if vCPU0 is dereferenced and kvm_vm_ioctl_create_vcpu() |
| bails out of vCPU creation due to an error and frees vCPU0. Commit |
| afb2acb2e3a3 ("KVM: Fix vcpu_array[0] races") papered over that issue, but |
| in doing so introduced an unsolvable teardown conundrum. Preventing |
| accesses to vCPU0 before it's fully online will allow reverting commit |
| afb2acb2e3a3, without re-introducing the vcpu_array[0] UAF race. |
| |
| The Linux kernel CVE team has assigned CVE-2024-58083 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.1 with commit 1d487e9bf8ba66a7174c56a0029c54b1eca8f99c and fixed in 5.4.291 with commit 5cce2ed69b00e022b5cdf0c49c82986abd2941a8 |
| Issue introduced in 5.1 with commit 1d487e9bf8ba66a7174c56a0029c54b1eca8f99c and fixed in 5.10.235 with commit 09d50ccf0b2d739db4a485b08afe7520a4402a63 |
| Issue introduced in 5.1 with commit 1d487e9bf8ba66a7174c56a0029c54b1eca8f99c and fixed in 5.15.179 with commit 7c4899239d0f70f88ac42665b3da51678d122480 |
| Issue introduced in 5.1 with commit 1d487e9bf8ba66a7174c56a0029c54b1eca8f99c and fixed in 6.1.129 with commit d817e510662fd1c9797952408d94806f97a5fffd |
| Issue introduced in 5.1 with commit 1d487e9bf8ba66a7174c56a0029c54b1eca8f99c and fixed in 6.6.78 with commit 125da53b3c0c9d7f58353aea0076e9efd6498ba7 |
| Issue introduced in 5.1 with commit 1d487e9bf8ba66a7174c56a0029c54b1eca8f99c and fixed in 6.12.14 with commit f2f805ada63b536bc192458a7098388286568ad4 |
| Issue introduced in 5.1 with commit 1d487e9bf8ba66a7174c56a0029c54b1eca8f99c and fixed in 6.13.3 with commit ca8da90ed1432ff3d000de4f1e2275d4e7d21b96 |
| Issue introduced in 5.1 with commit 1d487e9bf8ba66a7174c56a0029c54b1eca8f99c and fixed in 6.14 with commit 1e7381f3617d14b3c11da80ff5f8a93ab14cfc46 |
| Issue introduced in 4.14.120 with commit 559e2696d2f47a3575e9550f101a7e59e30b1b38 |
| Issue introduced in 4.19.44 with commit d39f3cc71382165bb7efb8e06a2bd32f847de4ae |
| Issue introduced in 5.0.17 with commit 7cee966029037a183d98cb88251ceb92a233fe63 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-58083 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| include/linux/kvm_host.h |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/5cce2ed69b00e022b5cdf0c49c82986abd2941a8 |
| https://git.kernel.org/stable/c/09d50ccf0b2d739db4a485b08afe7520a4402a63 |
| https://git.kernel.org/stable/c/7c4899239d0f70f88ac42665b3da51678d122480 |
| https://git.kernel.org/stable/c/d817e510662fd1c9797952408d94806f97a5fffd |
| https://git.kernel.org/stable/c/125da53b3c0c9d7f58353aea0076e9efd6498ba7 |
| https://git.kernel.org/stable/c/f2f805ada63b536bc192458a7098388286568ad4 |
| https://git.kernel.org/stable/c/ca8da90ed1432ff3d000de4f1e2275d4e7d21b96 |
| https://git.kernel.org/stable/c/1e7381f3617d14b3c11da80ff5f8a93ab14cfc46 |
