High · published February 23, 2024
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
There is a potential UAF scenario in the case of an LPI translation
cache hit racing with an operation that invalidates the cache, such
as a DISCARD ITS command. The root of the problem is that
vgic_its_check_cache() does not elevate the refcount on the vgic_irq
before dropping the lock that serializes refcount changes.
Have vgic_its_check_cache() raise the refcount on the returned vgic_irq
and add the corresponding decrement after queueing the interrupt.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 5.4, < 5.4.269 | 5.4.269 |
| linux/linux_kernel | ≥ 5.5, < 5.10.209 | 5.10.209 |
| linux/linux_kernel | ≥ 5.11, < 5.15.148 | 5.15.148 |
| linux/linux_kernel | ≥ 5.16, < 6.1.75 | 6.1.75 |
| linux/linux_kernel | ≥ 6.2, < 6.6.14 | 6.6.14 |
| linux/linux_kernel | ≥ 6.7, < 6.7.2 | 6.7.2 |
| debian/debian_linux | all versions | — |