CVE-2024-43819: kvm: s390: Reject memory region operations for ucontrol VMs
In the Linux kernel, the following vulnerability has been resolved:
kvm: s390: Reject memory region operations for ucontrol VMs
This change rejects the KVMSETUSERMEMORYREGION and KVMSETUSERMEMORYREGION2 ioctls when called on a ucontrol VM. This is necessary since ucontrol VMs have kvm->arch.gmap set to 0 and would thus result in a null pointer dereference further in. Memory management needs to be performed in userspace and using the ioctls KVMS390UCASMAP and KVMS390UCASUNMAP.
Also improve s390 specific documentation for KVMSETUSERMEMORYREGION and KVMSETUSERMEMORYREGION2.
[frankja@linux.ibm.com: commit message spelling fix, subject prefix fix]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.25-1 - Compensating control
For s390 ucontrol VMs, perform memory management in userspace using the KVM_S390_UCAS_MAP and KVM_S390_UCAS_UNMAP ioctls instead of KVM_SET_USER_MEMORY_REGION or KVM_SET_USER_MEMORY_REGION2.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43819?
CVE-2024-43819 has a moderate severity level due to its impact on memory operations in user control VMs.
How do I fix CVE-2024-43819?
To fix CVE-2024-43819, update the Linux Kernel to version 6.12.11-1 or later.
Which versions of the Linux Kernel are affected by CVE-2024-43819?
CVE-2024-43819 affects Linux Kernel versions from 3.4 to 6.10.3.
What types of systems are vulnerable to CVE-2024-43819?
Systems running affected Linux Kernel versions with KVM enabled may be vulnerable to CVE-2024-43819.
Are there any specific configurations that are impacted by CVE-2024-43819?
Yes, the vulnerability specifically impacts user control VMs concerning memory region operations.