CVE-2024-35791: KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Flush pages under kvm->lock to fix UAF in svmregisterencregion()
Do the cache flush of converted pages in svmregisterencregion() before dropping kvm->lock to fix use-after-free issues where region and/or its array of pages could be freed by a different task, e.g. if userspace has unregisterencregionlocked() already queued up for the region.
Note, the "obvious" alternative of using local variables doesn't fully resolve the bug, as region->pages is also dynamically allocated. I.e. the region structure itself would be fine, but region->pages could be freed.
Flushing multiple pages under kvm->lock is unfortunate, but the entire flow is a rare slow path, and the manual flush is only needed on CPUs that lack coherency for encrypted memory.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Flush pages under kvm->lock to fix UAF in svmregisterencregion()
The Linux kernel CVE team has assigned CVE-2024-35791 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051708-CVE-2024-35791-65ad@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.215 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.154 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.84 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.24 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.12 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8 - Compensating control
Apply the upstream fix described for KVM SVM by ensuring the cache flush of converted pages in svm_register_enc_region() is performed while holding kvm->lock, and only then drop kvm->lock, to prevent UAF where region and/or region->pages could be freed by a different task. (This corresponds to the change titled: “KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()”.)
- Compensating control
If patching is not immediately possible, mitigate by only relying on systems/CPUs that have coherency for encrypted memory, since the manual flush is only needed on CPUs that lack coherency for encrypted memory (per the description: “the manual flush is only needed on CPUs that lack coherency for encrypted memory”).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35791?
CVE-2024-35791 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-35791?
To fix CVE-2024-35791, upgrade your Linux kernel to the specified secure versions: 5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12, and 6.8, or the listed Debian kernel updates.
Which systems are impacted by CVE-2024-35791?
CVE-2024-35791 impacts various versions of the Linux kernel across multiple distributions including Red Hat and Debian.
What type of vulnerability is CVE-2024-35791?
CVE-2024-35791 is a use-after-free (UAF) vulnerability related to the KVM subsystem in the Linux kernel.
When was CVE-2024-35791 resolved?
CVE-2024-35791 was resolved with a patch provided in a kernel update shortly after its identification.