CVE-2024-26785: iommufd: Fix protection fault in iommufd_test_syz_conv_iova
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix protection fault in iommufdtestsyzconviova
Syzkaller reported the following bug:
general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] Call Trace: lockacquire lockacquire+0x1ce/0x4f0 downread+0x93/0x4a0 iommufdtestsyzconviova+0x56/0x1f0 iommufdtestaccessrw.isra.0+0x2ec/0x390 iommufdtest+0x1058/0x1e30 iommufdfopsioctl+0x381/0x510 vfsioctl dosysioctl sesysioctl x64sysioctl+0x170/0x1e0 dosyscallx64 dosyscall64+0x71/0x140
This is because the new iommufdaccesschangeioas() sets access->ioas to NULL during its process, so the lock might be gone in a concurrent racing context.
Fix this by doing the same access->ioas sanity as iommufdaccessrw() and iommufdaccesspinpages() functions do.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix protection fault in iommufdtestsyzconviova
The Linux kernel CVE team has assigned CVE-2024-26785 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040459-CVE-2024-26785-857d@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.9 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.85.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26785?
CVE-2024-26785 has been identified with a general protection fault vulnerability that could potentially lead to system crashes.
How do I fix CVE-2024-26785?
To mitigate CVE-2024-26785, ensure that your kernel package is upgraded to version 6.7.9 or 6.8 from Red Hat.
Which systems are affected by CVE-2024-26785?
CVE-2024-26785 specifically affects certain versions of the Red Hat kernel.
What are the symptoms of CVE-2024-26785?
Symptoms of CVE-2024-26785 may include system instability and the occurrence of general protection faults.
Is CVE-2024-26785 exploitable?
While CVE-2024-26785 indicates a significant issue, its exploitability depends on specific system configurations and usage patterns.