CVE-2024-41096: PCI/MSI: Fix UAF in msi_capability_init
In the Linux kernel, the following vulnerability has been resolved:
PCI/MSI: Fix UAF in msicapabilityinit
KFENCE reports the following UAF:
BUG: KFENCE: use-after-free read in pcienablemsirange+0x2c0/0x488
Use-after-free read at 0x0000000024629571 (in kfence-#12): pcienablemsirange+0x2c0/0x488 pciallocirqvectorsaffinity+0xec/0x14c pciallocirqvectors+0x18/0x28
kfence-#12: 0x0000000008614900-0x00000000e06c228d, size=104, cache=kmalloc-128
allocated by task 81 on cpu 7 at 10.808142s: kmemcacheallocnode+0x1f0/0x2bc kmalloctrace+0x44/0x138 msiallocdesc+0x3c/0x9c msidomaininsertmsidesc+0x30/0x78 msisetupmsidesc+0x13c/0x184 pcienablemsirange+0x258/0x488 pciallocirqvectorsaffinity+0xec/0x14c pciallocirqvectors+0x18/0x28
freed by task 81 on cpu 7 at 10.811436s: msidomainfreedescs+0xd4/0x10c msidomainfreelocked.part.0+0xc0/0x1d8 msidomainallocirqsalllocked+0xb4/0xbc pcimsisetupmsiirqs+0x30/0x4c pcienablemsirange+0x2a8/0x488 pciallocirqvectorsaffinity+0xec/0x14c pciallocirqvectors+0x18/0x28
Descriptor allocation done in: pcienablemsirange msicapabilityinit msisetupmsidesc msiinsertmsidesc msidomaininsertmsidesc msiallocdesc ...
Freed in case of failure in msidomainalloclocked() pcienablemsirange msicapabilityinit pcimsisetupmsiirqs msidomainallocirqsalllocked msidomainalloclocked msidomainalloclocked => fails msidomainfreelocked ...
That failure propagates back to pcimsisetupmsiirqs() in msicapabilityinit() which accesses the descriptor for unmasking in the error exit path.
Cure it by copying the descriptor and using the copy for the error exit path unmask operation.
[ tglx: Massaged change log ]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.37 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9.8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.133-1Fixed in 6.12.22-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41096?
CVE-2024-41096 is classified as a high severity vulnerability due to the potential for use-after-free exploitation in the Linux kernel.
What systems are affected by CVE-2024-41096?
CVE-2024-41096 affects multiple versions of the Linux kernel including versions prior to 6.6.37, 6.9.8, and 6.10.
How do I fix CVE-2024-41096?
To remediate CVE-2024-41096, update your Linux kernel to the latest versions: 6.6.37, 6.9.8, 6.10 or applicable patched versions.
What are the symptoms of CVE-2024-41096 exploitation?
Exploitation of CVE-2024-41096 may lead to system crashes or unexpected behavior due to use-after-free vulnerabilities.
Can CVE-2024-41096 be exploited remotely?
Yes, CVE-2024-41096 may allow remote code execution through crafted PCI/MSI requests, increasing the risk of exploitation.