Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes. Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 6211753fdfd05af9e08f54c8d0ba3ee516034878 before d04acadb6490aa3314f9c9e087691e55de153b88; affected 6211753fdfd05af9e08f54c8d0ba3ee516034878 before ba7be666740847d967822bed15500656b26bc703; affected 6211753fdfd05af9e08f54c8d0ba3ee516034878 before 12c2759ab1343c124ed46ba48f27bd1ef5d2dff4; affected 6211753fdfd05af9e08f54c8d0ba3ee516034878 before dba788e25f05209adf2b0175eb1691dc89fb1ba6; affected 6211753fdfd05af9e08f54c8d0ba3ee516034878 before 65b201bf3e9af1b0254243a5881390eda56f72d1; affected 6211753fdfd05af9e08f54c8d0ba3ee516034878 before dd3956a1b3dd11f46488c928cb890d6937d1ca80; affected 6211753fdfd05af9e08f54c8d0ba3ee516034878 before ad362fe07fecf0aba839ff2cc59a3617bd42c33f |
| Linux / Linux | affected 3.11; unaffected 0 before 3.11; unaffected 5.4.269 through 5.4.*; unaffected 5.10.209 through 5.10.*; unaffected 5.15.148 through 5.15.*; unaffected 6.1.75 through 6.1.*; unaffected 6.6.14 through 6.6.*; unaffected 6.7.2 through 6.7.*; unaffected 6.8 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/d04acadb6490aa3314f9c9e087691e55de153b88
- https://git.kernel.org/stable/c/ba7be666740847d967822bed15500656b26bc703
- https://git.kernel.org/stable/c/12c2759ab1343c124ed46ba48f27bd1ef5d2dff4
- https://git.kernel.org/stable/c/dba788e25f05209adf2b0175eb1691dc89fb1ba6
- https://git.kernel.org/stable/c/65b201bf3e9af1b0254243a5881390eda56f72d1
- https://git.kernel.org/stable/c/dd3956a1b3dd11f46488c928cb890d6937d1ca80
- https://git.kernel.org/stable/c/ad362fe07fecf0aba839ff2cc59a3617bd42c33f
ADP enrichment
No English description supplied.
- https://git.kernel.org/stable/c/d04acadb6490aa3314f9c9e087691e55de153b88
- https://git.kernel.org/stable/c/ba7be666740847d967822bed15500656b26bc703
- https://git.kernel.org/stable/c/12c2759ab1343c124ed46ba48f27bd1ef5d2dff4
- https://git.kernel.org/stable/c/dba788e25f05209adf2b0175eb1691dc89fb1ba6
- https://git.kernel.org/stable/c/65b201bf3e9af1b0254243a5881390eda56f72d1
- https://git.kernel.org/stable/c/dd3956a1b3dd11f46488c928cb890d6937d1ca80
- https://git.kernel.org/stable/c/ad362fe07fecf0aba839ff2cc59a3617bd42c33f
- https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html
No English description supplied.
No references supplied.