CVE-2024-49863: vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()
In the Linux kernel, the following vulnerability has been resolved:
vhost/scsi: null-ptr-dereference in vhostscsigetreq()
Since commit 3f8ca2e115e5 ("vhost/scsi: Extract common handling code from control queue handler") a null pointer dereference bug can be triggered when guest sends an SCSI AN request.
In vhostscsictlhandlevq(), vc.target is assigned with &vreq.tmf.lun[1] within a switch-case block and is then passed to vhostscsigetreq() which extracts vc->req and tpg. However, for a VIRTIOSCSITAN request, tpg is not required, so vc.target is set to NULL in this branch. Later, in vhostscsigetreq(), vc->target is dereferenced without being checked, leading to a null pointer dereference bug. This bug can be triggered from guest.
When this bug occurs, the vhostworker process is killed while holding vq->mutex and the corresponding tpg will remain occupied indefinitely.
Below is the KASAN report: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 PID: 840 Comm: poc Not tainted 6.10.0+ #1 Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:vhostscsigetreq+0x165/0x3a0 Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 2b 02 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 65 30 4c 89 e2 48 c1 ea 03 <0f> b6 04 02 4c 89 e2 83 e2 07 38 d0 7f 08 84 c0 0f 85 be 01 00 00 RSP: 0018:ffff888017affb50 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffff88801b000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888017affcb8 RBP: ffff888017affb80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888017affc88 R14: ffff888017affd1c R15: ffff888017993000 FS: 000055556e076500(0000) GS:ffff88806b100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200027c0 CR3: 0000000010ed0004 CR4: 0000000000370ef0 Call Trace: <TASK> ? showregs+0x86/0xa0 ? dieaddr+0x4b/0xd0 ? excgeneralprotection+0x163/0x260 ? asmexcgeneralprotection+0x27/0x30 ? vhostscsigetreq+0x165/0x3a0 vhostscsictlhandlevq+0x2a4/0xca0 ? pfxvhostscsictlhandlevq+0x10/0x10 ? switchto+0x721/0xeb0 ? schedule+0xda5/0x5710 ? kasancheckwrite+0x14/0x30 ? rawspinlock+0x82/0xf0 vhostscsictlhandlekick+0x52/0x90 vhostrunworklist+0x134/0x1b0 vhosttaskfn+0x121/0x350 ... </TASK> ---[ end trace 0000000000000000 ]---
Let's add a check in vhostscsigetreq.
[whitespace fixes]
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49863?
CVE-2024-49863 is classified as a high severity vulnerability due to its potential to cause a null pointer dereference in the Linux kernel.
How do I fix CVE-2024-49863?
To mitigate CVE-2024-49863, you should upgrade to a patched version of the Linux kernel, specifically versions 6.12.11 or 6.12.12.
What versions of the Linux kernel are affected by CVE-2024-49863?
CVE-2024-49863 affects multiple versions of the Linux kernel including those from 4.20 up to 6.12-rc2.
What are the potential impacts of CVE-2024-49863?
The potential impacts of CVE-2024-49863 include system crashes and denial of service due to the null pointer dereference.
Which Linux distributions are likely affected by CVE-2024-49863?
CVE-2024-49863 is likely to affect any Linux distribution that uses the vulnerable versions of the kernel, particularly Debian-based systems.