Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2024-38610

drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() Patch series "mm: follow_pte() improvements and acrn follow_pte() fixes". Patch #1 fixes a bunch of issues I spotted in the acrn driver. It compiles, that's all I know. I'll appreciate some review and testing from acrn folks. Patch #2+#3 improve follow_pte(), passing a VMA instead of the MM, adding more sanity checks, and improving the documentation. Gave it a quick test on x86-64 using VM_PAT that ends up using follow_pte(). This patch (of 3): We currently miss handling various cases, resulting in a dangerous follow_pte() (previously follow_pfn()) usage. (1) We're not checking PTE write permissions. Maybe we should simply always require pte_write() like we do for pin_user_pages_fast(FOLL_WRITE)? Hard to tell, so let's check for ACRN_MEM_ACCESS_WRITE for now. (2) We're not rejecting refcounted pages. As we are not using MMU notifiers, messing with refcounted pages is dangerous and can result in use-after-free. Let's make sure to reject them. (3) We are only looking at the first PTE of a bigger range. We only lookup a single PTE, but memmap->len may span a larger area. Let's loop over all involved PTEs and make sure the PFN range is actually contiguous. Reject everything else: it couldn't have worked either way, and rather made use access PFNs we shouldn't be accessing.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • b9c43aa0b18da5619aac347d54cb67fe30d1f884 to < 5c6705aa47b5b78d7ad36fea832bb69caa5bf49aaffected
  • 8a6e85f75a83d16a71077e41f2720c691f432002 to < afeb0e69627695f759fc73c39c1640dbf8649b32affected
  • 8a6e85f75a83d16a71077e41f2720c691f432002 to < e873f36ec890bece26ecce850e969917bceebbb6affected
  • 8a6e85f75a83d16a71077e41f2720c691f432002 to < 4c4ba3cf3a15ccfbaf787d0296fa42cdb00da9b4affected
  • 8a6e85f75a83d16a71077e41f2720c691f432002 to < 2c8d6e24930b8ef7d4a81787627c559ae0e0d3bbaffected
  • 8a6e85f75a83d16a71077e41f2720c691f432002 to < 3d6586008f7b638f91f3332602592caa8b00b559affected
  • 149d5fb7e0124c3763e92edd1fde19417f4d2d09affected
  • 02098ac42b7ff055ec72cd083ee1eb0a23481a19affected
  • 5.15.33 to < 5.15.161affected
  • 5.16.19 to < 5.17affected
  • 5.17.2 to < 5.18affected

Linux Linux

Default version status: affected

  • 5.18affected
  • 0 to < 5.18unaffected
  • 5.15.161 to ≤ 5.15.*unaffected
  • 6.1.93 to ≤ 6.1.*unaffected
  • 6.6.33 to ≤ 6.6.*unaffected
  • 6.8.12 to ≤ 6.8.*unaffected
  • 6.9.3 to ≤ 6.9.*unaffected
  • 6.10 to ≤ *unaffected

References