CVE-2024-53092: virtio_pci: Fix admin vq cleanup by using correct info pointer
In the Linux kernel, the following vulnerability has been resolved:
virtiopci: Fix admin vq cleanup by using correct info pointer
vpmodernavqcleanup() and vpdelvqs() clean up admin vq resources by virtiopcivqinfo pointer. The info pointer of admin vq is stored in vpdev->adminvq.info instead of vpdev->vqs[]. Using the info pointer from vpdev->vqs[] for admin vq causes a kernel NULL pointer dereference bug. In vpmodernavqcleanup() and vpdelvqs(), get the info pointer from vpdev->adminvq.info for admin vq to clean up the resources. Also make info ptr as argument of vpdelvq() to be symmetric with vpsetupvq().
vpreset calls vpmodernavqcleanup, and causes the Call Trace: ================================================================== BUG: kernel NULL pointer dereference, address:0000000000000000 ... CPU: 49 UID: 0 PID: 4439 Comm: modprobe Not tainted 6.11.0-rc5 #1 RIP: 0010:vpreset+0x57/0x90 [virtiopci] Call Trace: <TASK> ... ? vpreset+0x57/0x90 [virtiopci] ? vpreset+0x38/0x90 [virtiopci] virtioresetdevice+0x1d/0x30 removevqcommon+0x1c/0x1a0 [virtionet] virtnetremove+0xa1/0xc0 [virtionet] virtiodevremove+0x46/0xa0 ... virtiopcidriverexit+0x14/0x810 [virtiopci] ==================================================================
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Configuration
In vp_modern_avq_cleanup() and vp_del_vqs(), get the info pointer for the admin vq from vp_dev->admin_vq.info (not from vp_dev->vqs[]), and make vp_del_vq() take the info pointer as an argument to be symmetric with vp_setup_vq().
virtio_pci (Linux kernel) admin vq info pointer source = vp_dev->admin_vq.info
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53092?
CVE-2024-53092 has a severity rating that requires attention due to its potential impact on the Linux kernel's admin virtual queue resources.
How do I fix CVE-2024-53092?
To fix CVE-2024-53092, update your Linux kernel to the latest version beyond 6.11.9 or to a stable release post 6.12-rc7.
Which Linux kernel versions are affected by CVE-2024-53092?
CVE-2024-53092 affects Linux kernel versions from 6.11 to 6.12-rc7.
What components are vulnerable in CVE-2024-53092?
CVE-2024-53092 specifically impacts the virtio_pci module related to the cleanup of admin virtual queue resources.
What issues does CVE-2024-53092 resolve in the Linux kernel?
CVE-2024-53092 addresses issues related to the improper cleanup of admin virtual queue information pointers in the Linux kernel.