CVE-2024-53195: KVM: arm64: Get rid of userspace_irqchip_in_use
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Get rid of userspaceirqchipinuse
Improper use of userspaceirqchipinuse led to syzbot hitting the following WARNON() in kvmtimerupdateirq():
WARNING: CPU: 0 PID: 3281 at arch/arm64/kvm/archtimer.c:459 kvmtimerupdateirq+0x21c/0x394 Call trace: kvmtimerupdateirq+0x21c/0x394 arch/arm64/kvm/archtimer.c:459 kvmtimervcpureset+0x158/0x684 arch/arm64/kvm/archtimer.c:968 kvmresetvcpu+0x3b4/0x560 arch/arm64/kvm/reset.c:264 kvmvcpusettarget arch/arm64/kvm/arm.c:1553 [inline] kvmarchvcpuioctlvcpuinit arch/arm64/kvm/arm.c:1573 [inline] kvmarchvcpuioctl+0x112c/0x1b3c arch/arm64/kvm/arm.c:1695 kvmvcpuioctl+0x4ec/0xf74 virt/kvm/kvmmain.c:4658 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:907 [inline] sesysioctl fs/ioctl.c:893 [inline] arm64sysioctl+0x108/0x184 fs/ioctl.c:893 invokesyscall arch/arm64/kernel/syscall.c:35 [inline] invokesyscall+0x78/0x1b8 arch/arm64/kernel/syscall.c:49 el0svccommon+0xe8/0x1b0 arch/arm64/kernel/syscall.c:132 doel0svc+0x40/0x50 arch/arm64/kernel/syscall.c:151 el0svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712 el0t64synchandler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t64sync+0x190/0x194 arch/arm64/kernel/entry.S:598
The following sequence led to the scenario: - Userspace creates a VM and a vCPU. - The vCPU is initialized with KVMARMVCPUPMUV3 during KVMARMVCPUINIT. - Without any other setup, such as vGIC or vPMU, userspace issues KVMRUN on the vCPU. Since the vPMU is requested, but not setup, kvmarmpmuv3enable() fails in kvmarchvcpurunpidchange(). As a result, KVMRUN returns after enabling the timer, but before incrementing 'userspaceirqchipinuse': kvmarchvcpurunpidchange() ret = kvmarmpmuv3enable() if (!vcpu->arch.pmu.created) return -EINVAL; if (ret) return ret; [...] if (!irqchipinkernel(kvm)) staticbranchinc(&userspaceirqchipinuse); - Userspace ignores the error and issues KVMARMVCPUINIT again. Since the timer is already enabled, control moves through the following flow, ultimately hitting the WARNON(): kvmtimervcpureset() if (timer->enabled) kvmtimerupdateirq() if (!userspaceirqchip()) ret = kvmvgicinjectirq() ret = vgiclazyinit() if (unlikely(!vgicinitialized(kvm))) if (kvm->arch.vgic.vgicmodel != KVMDEVTYPEARMVGICV2) return -EBUSY; WARNON(ret);
Theoretically, since userspaceirqchipinuse's functionality can be simply replaced by '!irqchipinkernel()', get rid of the static key to avoid the mismanagement, which also helps with the syzbot issue.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.3-1 - Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1027.29~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1027.32~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1028.30~22.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-58.60~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1024.24~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-58.60.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1026.29~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1024.25~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-58.60.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1020.21~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-58.60 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1027.29 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1027.32 - Upgrade
Upgrade
ubuntu/linux-azure-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1012.12~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1014.15 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1028.30 - Upgrade
Upgrade
ubuntu/linux-gcp-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1011.11~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1023.27 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1010.12 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1024.24 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-58.60.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1026.29 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1026.29.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-oem-6.11to a version that resolves this vulnerability.Fixed in 6.11.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oem-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1026.26 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1024.25 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1028.32 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 6.8.0-58.60.1 - Upgrade
Upgrade
ubuntu/linux-xilinxto a version that resolves this vulnerability.Fixed in 6.8.0-1017.18 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2023.24 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1020.21 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-78.78+fips1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.64 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.11.11 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53195?
CVE-2024-53195 is classified as a low severity vulnerability in the Linux kernel.
How do I fix CVE-2024-53195?
To fix CVE-2024-53195, upgrade your Linux kernel to version 6.12.12-1, 6.12.15-1 or any version above the affected releases, including 5.10.226-1, 6.1.128-1 or higher.
Which versions of the Linux kernel are affected by CVE-2024-53195?
CVE-2024-53195 affects Linux kernel versions up to and including 5.10.223-1, 5.10.226-1, 6.1.123-1, and 6.1.128-1.
What does CVE-2024-53195 pertain to in the Linux kernel?
CVE-2024-53195 pertains to improper handling of the userspace_irqchip_in_use which could lead to warnings in the KVM's timer handling.
Is there a public reference for CVE-2024-53195?
Yes, CVE-2024-53195 has several public references available through the Linux kernel's stable tree commits.