Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes. Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
6211753fdfd05af9e08f54c8d0ba3ee516034878 to < d04acadb6490aa3314f9c9e087691e55de153b88affected6211753fdfd05af9e08f54c8d0ba3ee516034878 to < ba7be666740847d967822bed15500656b26bc703affected6211753fdfd05af9e08f54c8d0ba3ee516034878 to < 12c2759ab1343c124ed46ba48f27bd1ef5d2dff4affected6211753fdfd05af9e08f54c8d0ba3ee516034878 to < dba788e25f05209adf2b0175eb1691dc89fb1ba6affected6211753fdfd05af9e08f54c8d0ba3ee516034878 to < 65b201bf3e9af1b0254243a5881390eda56f72d1affected6211753fdfd05af9e08f54c8d0ba3ee516034878 to < dd3956a1b3dd11f46488c928cb890d6937d1ca80affected6211753fdfd05af9e08f54c8d0ba3ee516034878 to < ad362fe07fecf0aba839ff2cc59a3617bd42c33faffected
Linux Linux
Default version status: affected
3.11affected0 to < 3.11unaffected5.4.269 to ≤ 5.4.*unaffected5.10.209 to ≤ 5.10.*unaffected5.15.148 to ≤ 5.15.*unaffected6.1.75 to ≤ 6.1.*unaffected6.6.14 to ≤ 6.6.*unaffected6.7.2 to ≤ 6.7.*unaffected6.8 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/d04acadb6490aa3314f9c9e087691e55de153b88 ↗
- https://git.kernel.org/stable/c/ba7be666740847d967822bed15500656b26bc703 ↗
- https://git.kernel.org/stable/c/12c2759ab1343c124ed46ba48f27bd1ef5d2dff4 ↗
- https://git.kernel.org/stable/c/dba788e25f05209adf2b0175eb1691dc89fb1ba6 ↗
- https://git.kernel.org/stable/c/65b201bf3e9af1b0254243a5881390eda56f72d1 ↗
- https://git.kernel.org/stable/c/dd3956a1b3dd11f46488c928cb890d6937d1ca80 ↗
- https://git.kernel.org/stable/c/ad362fe07fecf0aba839ff2cc59a3617bd42c33f ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html ↗