CVE-2024-26786: iommufd: Fix iopt_access_list_id overwrite bug
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix ioptaccesslistid overwrite bug
Syzkaller reported the following WARNON: WARNING: CPU: 1 PID: 4738 at drivers/iommu/iommufd/iopagetable.c:1360
Call Trace: iommufdaccesschangeioas+0x2fe/0x4e0 iommufdaccessdestroyobject+0x50/0xb0 iommufdobjectremove+0x2a3/0x490 iommufdobjectdestroyuser iommufdaccessdestroy+0x71/0xb0 iommufdteststaccessrelease+0x89/0xd0 fput+0x272/0xb50 fputsync+0x4b/0x60 dosysclose sesysclose x64sysclose+0x8b/0x110 dosyscallx64
The mismatch between the access pointer in the list and the passed-in pointer is resulting from an overwrite of access->ioptaccesslistid, in ioptaddaccess(). Called from iommufdaccesschangeioas() when xaalloc() succeeds but ioptcalculateiovaalignment() fails.
Add a newid in ioptaddaccess() and only update ioptaccesslistid when returning successfully.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix ioptaccesslistid overwrite bug
The Linux kernel CVE team has assigned CVE-2024-26786 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040459-CVE-2024-26786-802f@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.21 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.9 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.7.9-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26786?
CVE-2024-26786 has a moderate severity level due to potential information disclosure risks.
How do I fix CVE-2024-26786?
To fix CVE-2024-26786, update the Linux kernel to version 6.6.21, 6.7.9, or 6.8 as recommended.
What are the affected versions for CVE-2024-26786?
CVE-2024-26786 affects Linux kernel versions prior to 6.6.21, 6.7.9, and 6.8.
What type of vulnerability is CVE-2024-26786?
CVE-2024-26786 is primarily an access control vulnerability in the Linux kernel.
Who reported CVE-2024-26786?
CVE-2024-26786 was reported by Syzkaller, a tool for testing kernel vulnerabilities.