CVE-2024-50139: KVM: arm64: Fix shift-out-of-bounds bug
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Fix shift-out-of-bounds bug
Fix a shift-out-of-bounds bug reported by UBSAN when running VM with MTE enabled host kernel.
UBSAN: shift-out-of-bounds in arch/arm64/kvm/sysregs.c:1988:14 shift exponent 33 is too large for 32-bit type 'int' CPU: 26 UID: 0 PID: 7629 Comm: qemu-kvm Not tainted 6.12.0-rc2 #34 Hardware name: IEI NF5280R7/Mitchell MB, BIOS 00.00. 2024-10-12 09:28:54 10/14/2024 Call trace: dumpbacktrace+0xa0/0x128 showstack+0x20/0x38 dumpstacklvl+0x74/0x90 dumpstack+0x18/0x28 ubsanhandleshiftoutofbounds+0xf8/0x1e0 resetclidr+0x10c/0x1c8 kvmresetsysregs+0x50/0x1c8 kvmresetvcpu+0xec/0x2b0 kvmvcpusettarget+0x84/0x158 kvmvcpusettarget+0x138/0x168 kvmarchvcpuioctlvcpuinit+0x40/0x2b0 kvmarchvcpuioctl+0x28c/0x4b8 kvmvcpuioctl+0x4bc/0x7a8 arm64sysioctl+0xb4/0x100 invokesyscall+0x70/0x100 el0svccommon.constprop.0+0x48/0xf0 doel0svc+0x24/0x38 el0svc+0x3c/0x158 el0t64synchandler+0x120/0x130 el0t64sync+0x194/0x198
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.133-1Fixed in 6.12.22-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50139?
The severity of CVE-2024-50139 is considered medium due to its potential impact on system stability.
How do I fix CVE-2024-50139?
To fix CVE-2024-50139, update the Linux kernel to the latest stable version that addresses the vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-50139?
CVE-2024-50139 affects Linux kernel versions between 6.3 and 6.6.59, as well as versions 6.7 to 6.11.6, and the 6.12 release candidates.
Is there a workaround for CVE-2024-50139?
Currently, the recommended approach is to update the Linux kernel since no specific workaround is documented for this vulnerability.
What are the implications of CVE-2024-50139 on KVM hosts?
CVE-2024-50139 can lead to potential instability in KVM hosts running with MTE enabled, requiring immediate attention for mitigation.