Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() Do the cache flush of converted pages in svm_register_enc_region() before dropping kvm->lock to fix use-after-free issues where region and/or its array of pages could be freed by a different task, e.g. if userspace has __unregister_enc_region_locked() already queued up for the region. Note, the "obvious" alternative of using local variables doesn't fully resolve the bug, as region->pages is also dynamically allocated. I.e. the region structure itself would be fine, but region->pages could be freed. Flushing multiple pages under kvm->lock is unfortunate, but the entire flow is a rare slow path, and the manual flush is only needed on CPUs that lack coherency for encrypted memory.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 4f627ecde7329e476a077bb0590db8f27bb8f912 before 2d13b79640b147bd77c34a5998533b2021a4122d; affected 19a23da53932bc8011220bd8c410cb76012de004 before e126b508ed2e616d679d85fca2fbe77bb48bbdd7; affected 19a23da53932bc8011220bd8c410cb76012de004 before 4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865; affected 19a23da53932bc8011220bd8c410cb76012de004 before 12f8e32a5a389a5d58afc67728c76e61beee1ad4; affected 19a23da53932bc8011220bd8c410cb76012de004 before f6d53d8a2617dd58c89171a6b9610c470ebda38a; affected 19a23da53932bc8011220bd8c410cb76012de004 before 5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807; affected f1ecde00ce1694597f923f0d25f7a797c5243d99; affected 848bcb0a1d96f67d075465667d3a1ad4af56311e; affected 5.10.15 before 5.10.215; affected 4.19.176 before 4.20; affected 5.4.98 before 5.5 |
| Linux / Linux | affected 5.11; unaffected 0 before 5.11; unaffected 5.10.215 through 5.10.*; unaffected 5.15.154 through 5.15.*; unaffected 6.1.84 through 6.1.*; unaffected 6.6.24 through 6.6.*; unaffected 6.7.12 through 6.7.*; unaffected 6.8 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/2d13b79640b147bd77c34a5998533b2021a4122d
- https://git.kernel.org/stable/c/e126b508ed2e616d679d85fca2fbe77bb48bbdd7
- https://git.kernel.org/stable/c/4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865
- https://git.kernel.org/stable/c/12f8e32a5a389a5d58afc67728c76e61beee1ad4
- https://git.kernel.org/stable/c/f6d53d8a2617dd58c89171a6b9610c470ebda38a
- https://git.kernel.org/stable/c/5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807
ADP enrichment
No English description supplied.
- https://git.kernel.org/stable/c/2d13b79640b147bd77c34a5998533b2021a4122d
- https://git.kernel.org/stable/c/e126b508ed2e616d679d85fca2fbe77bb48bbdd7
- https://git.kernel.org/stable/c/4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865
- https://git.kernel.org/stable/c/12f8e32a5a389a5d58afc67728c76e61beee1ad4
- https://git.kernel.org/stable/c/f6d53d8a2617dd58c89171a6b9610c470ebda38a
- https://git.kernel.org/stable/c/5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
No English description supplied.
No references supplied.