CVE-2024-26598: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgicitscheckcache() does not elevate the refcount on the vgicirq before dropping the lock that serializes refcount changes.
Have vgicitscheckcache() raise the refcount on the returned vgicirq and add the corresponding decrement after queueing the interrupt.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8 - Configuration
Modify vgic_its_check_cache() to elevate (increment) the refcount on the returned vgic_irq before dropping the lock that serializes refcount changes, and then decrement the refcount after queueing the interrupt. This resolves a potential UAF when an LPI translation cache hit races with an operation that invalidates the cache (e.g., DISCARD ITS).
Linux kernel (KVM arm64 vgic-its) vgic_its_check_cache() refcount handling = raise refcount on returned vgic_irq before dropping the refcount-serialization lock; add corresponding decrement after queueing the interrupt
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26598?
CVE-2024-26598 has a medium severity due to the potential use-after-free vulnerability in the KVM component of the Linux kernel.
How do I fix CVE-2024-26598?
To fix CVE-2024-26598, upgrade to the patched versions of the kernel available in your distribution, such as kernel version 6.8 or specific Debian packages like 5.10.223-1.
Which operating systems are affected by CVE-2024-26598?
CVE-2024-26598 affects various distributions of Linux, including Red Hat and Debian, across multiple version ranges.
What components are impacted by CVE-2024-26598?
CVE-2024-26598 impacts the KVM component of the Linux kernel, specifically the virtual generic interrupt controller (VGIC) related to large physical interrupt (LPI) translation cache.
When was CVE-2024-26598 reported?
CVE-2024-26598 was reported in 2024 and was resolved shortly thereafter in subsequent kernel updates.