CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ
In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: Disable auto-enable of exclusive INTx IRQ
Currently for devices requiring masking at the irqchip for INTx, ie. devices without DisINTx support, the IRQ is enabled in requestirq() and subsequently disabled as necessary to align with the masked status flag. This presents a window where the interrupt could fire between these events, resulting in the IRQ incrementing the disable depth twice. This would be unrecoverable for a user since the masked flag prevents nested enables through vfio.
Instead, invert the logic using IRQFNOAUTOEN such that exclusive INTx is never auto-enabled, then unmask as required.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: Disable auto-enable of exclusive INTx IRQ
The Linux kernel CVE team has assigned CVE-2024-27437 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040551-CVE-2024-27437-cc07@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.84 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.24 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.12 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.3 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.176.3-3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27437?
CVE-2024-27437 has a moderate severity level due to potential disruption in IRQ handling.
How do I fix CVE-2024-27437?
To fix CVE-2024-27437, update the Linux kernel to versions 6.1.84 or higher for Red Hat and to specified versions for Debian.
Which systems are affected by CVE-2024-27437?
CVE-2024-27437 affects systems running specific vulnerable versions of the Linux kernel, including Red Hat and Debian distributions.
What is the impact of CVE-2024-27437?
The impact of CVE-2024-27437 could result in improper IRQ handling leading to system instability or unexpected behavior.
Is there a workaround for CVE-2024-27437?
Currently, there is no documented workaround for CVE-2024-27437; updating the kernel is the recommended solution.