CVE-2024-26598

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26598
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes. Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/12c2759ab1343c124ed46ba48f27bd1ef5d2dff4 Patch
https://git.kernel.org/stable/c/65b201bf3e9af1b0254243a5881390eda56f72d1 Patch
https://git.kernel.org/stable/c/ad362fe07fecf0aba839ff2cc59a3617bd42c33f Patch
https://git.kernel.org/stable/c/ba7be666740847d967822bed15500656b26bc703 Patch
https://git.kernel.org/stable/c/d04acadb6490aa3314f9c9e087691e55de153b88 Patch
https://git.kernel.org/stable/c/dba788e25f05209adf2b0175eb1691dc89fb1ba6 Patch
https://git.kernel.org/stable/c/dd3956a1b3dd11f46488c928cb890d6937d1ca80 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

17 Apr 2024, 19:40

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/12c2759ab1343c124ed46ba48f27bd1ef5d2dff4 - () https://git.kernel.org/stable/c/12c2759ab1343c124ed46ba48f27bd1ef5d2dff4 - Patch
References () https://git.kernel.org/stable/c/65b201bf3e9af1b0254243a5881390eda56f72d1 - () https://git.kernel.org/stable/c/65b201bf3e9af1b0254243a5881390eda56f72d1 - Patch
References () https://git.kernel.org/stable/c/ad362fe07fecf0aba839ff2cc59a3617bd42c33f - () https://git.kernel.org/stable/c/ad362fe07fecf0aba839ff2cc59a3617bd42c33f - Patch
References () https://git.kernel.org/stable/c/ba7be666740847d967822bed15500656b26bc703 - () https://git.kernel.org/stable/c/ba7be666740847d967822bed15500656b26bc703 - Patch
References () https://git.kernel.org/stable/c/d04acadb6490aa3314f9c9e087691e55de153b88 - () https://git.kernel.org/stable/c/d04acadb6490aa3314f9c9e087691e55de153b88 - Patch
References () https://git.kernel.org/stable/c/dba788e25f05209adf2b0175eb1691dc89fb1ba6 - () https://git.kernel.org/stable/c/dba788e25f05209adf2b0175eb1691dc89fb1ba6 - Patch
References () https://git.kernel.org/stable/c/dd3956a1b3dd11f46488c928cb890d6937d1ca80 - () https://git.kernel.org/stable/c/dd3956a1b3dd11f46488c928cb890d6937d1ca80 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: arm64: vgic-its: Evite posibles UAF en la caché de traducción LPI. Existe un escenario potencial de UAF en el caso de que un caché de traducción LPI se acelere con una operación que invalide la caché, como un comando DISCARD ITS. La raíz del problema es que vgic_its_check_cache() no eleva el refcount en vgic_irq antes de eliminar el bloqueo que serializa los cambios de refcount. Haga que vgic_its_check_cache() aumente el refcount en el vgic_irq devuelto y agregue el decremento correspondiente después de poner en cola la interrupción.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-416

23 Feb 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-23 15:15

Updated : 2024-04-17 19:40

NVD link : CVE-2024-26598

Mitre link : CVE-2024-26598

CVE.ORG link : CVE-2024-26598

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free