In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgicitscheckcache() does not elevate the refcount on the vgicirq before dropping the lock that serializes refcount changes.
Have vgicitscheckcache() raise the refcount on the returned vgicirq and add the corresponding decrement after queueing the interrupt.
[ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd3956a1b3dd11f46488c928cb890d6937d1ca80", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c", "function": "vgic_its_check_cache" }, "digest": { "length": 311.0, "function_hash": "270275722975241669832619976181611758018" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2024-26598-048668e2" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad362fe07fecf0aba839ff2cc59a3617bd42c33f", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c" }, "digest": { "line_hashes": [ "310567826171508659484627165291753971134", "249555805787144725702720374496208452404", "162850934150674545887192199773214784059", "27628539130590181192552898767302328546", "310446865867122917342897301810556489418", "128576463119609286898045492747998034863", "70884871080497289231615493121931832234", "48584523849434757844197225332288018536", "167243345287186145739098519955665565393" ], "threshold": 0.9 }, "deprecated": false, "signature_type": "Line", "id": "CVE-2024-26598-0ad3c2c1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba7be666740847d967822bed15500656b26bc703", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c", "function": "vgic_its_check_cache" }, "digest": { "length": 311.0, "function_hash": "270275722975241669832619976181611758018" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2024-26598-1e18c4b8" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65b201bf3e9af1b0254243a5881390eda56f72d1", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c", "function": "vgic_its_inject_cached_translation" }, "digest": { "length": 380.0, "function_hash": "96877720148768009557046411371422861818" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2024-26598-208d6365" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dba788e25f05209adf2b0175eb1691dc89fb1ba6", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c", "function": "vgic_its_inject_cached_translation" }, "digest": { "length": 380.0, "function_hash": "96877720148768009557046411371422861818" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2024-26598-219a00d2" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dba788e25f05209adf2b0175eb1691dc89fb1ba6", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c" }, "digest": { "line_hashes": [ "310567826171508659484627165291753971134", "249555805787144725702720374496208452404", "162850934150674545887192199773214784059", "27628539130590181192552898767302328546", "310446865867122917342897301810556489418", "128576463119609286898045492747998034863", "70884871080497289231615493121931832234", "48584523849434757844197225332288018536", "167243345287186145739098519955665565393" ], "threshold": 0.9 }, "deprecated": false, "signature_type": "Line", "id": "CVE-2024-26598-274051b6" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12c2759ab1343c124ed46ba48f27bd1ef5d2dff4", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c", "function": "vgic_its_check_cache" }, "digest": { "length": 311.0, "function_hash": "270275722975241669832619976181611758018" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2024-26598-29e1d930" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65b201bf3e9af1b0254243a5881390eda56f72d1", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c" }, "digest": { "line_hashes": [ "310567826171508659484627165291753971134", "249555805787144725702720374496208452404", "162850934150674545887192199773214784059", "27628539130590181192552898767302328546", "310446865867122917342897301810556489418", "128576463119609286898045492747998034863", "70884871080497289231615493121931832234", "48584523849434757844197225332288018536", "167243345287186145739098519955665565393" ], "threshold": 0.9 }, "deprecated": false, "signature_type": "Line", "id": "CVE-2024-26598-373a13a5" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd3956a1b3dd11f46488c928cb890d6937d1ca80", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c" }, "digest": { "line_hashes": [ "310567826171508659484627165291753971134", "249555805787144725702720374496208452404", "162850934150674545887192199773214784059", "27628539130590181192552898767302328546", "310446865867122917342897301810556489418", "128576463119609286898045492747998034863", "70884871080497289231615493121931832234", "48584523849434757844197225332288018536", "167243345287186145739098519955665565393" ], "threshold": 0.9 }, "deprecated": false, "signature_type": "Line", "id": "CVE-2024-26598-512c6916" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12c2759ab1343c124ed46ba48f27bd1ef5d2dff4", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c" }, "digest": { "line_hashes": [ "310567826171508659484627165291753971134", "249555805787144725702720374496208452404", "162850934150674545887192199773214784059", "27628539130590181192552898767302328546", "310446865867122917342897301810556489418", "128576463119609286898045492747998034863", "70884871080497289231615493121931832234", "48584523849434757844197225332288018536", "167243345287186145739098519955665565393" ], "threshold": 0.9 }, "deprecated": false, "signature_type": "Line", "id": "CVE-2024-26598-77bd8ca2" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba7be666740847d967822bed15500656b26bc703", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c" }, "digest": { "line_hashes": [ "310567826171508659484627165291753971134", "249555805787144725702720374496208452404", "162850934150674545887192199773214784059", "27628539130590181192552898767302328546", "310446865867122917342897301810556489418", "128576463119609286898045492747998034863", "70884871080497289231615493121931832234", "48584523849434757844197225332288018536", "167243345287186145739098519955665565393" ], "threshold": 0.9 }, "deprecated": false, "signature_type": "Line", "id": "CVE-2024-26598-781e76d4" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba7be666740847d967822bed15500656b26bc703", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c", "function": "vgic_its_inject_cached_translation" }, "digest": { "length": 380.0, "function_hash": "96877720148768009557046411371422861818" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2024-26598-7fa6925e" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad362fe07fecf0aba839ff2cc59a3617bd42c33f", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c", "function": "vgic_its_inject_cached_translation" }, "digest": { "length": 380.0, "function_hash": "96877720148768009557046411371422861818" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2024-26598-aa39d451" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad362fe07fecf0aba839ff2cc59a3617bd42c33f", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c", "function": "vgic_its_check_cache" }, "digest": { "length": 311.0, "function_hash": "270275722975241669832619976181611758018" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2024-26598-afb0e2e1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12c2759ab1343c124ed46ba48f27bd1ef5d2dff4", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c", "function": "vgic_its_inject_cached_translation" }, "digest": { "length": 380.0, "function_hash": "96877720148768009557046411371422861818" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2024-26598-bd3212e9" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dba788e25f05209adf2b0175eb1691dc89fb1ba6", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c", "function": "vgic_its_check_cache" }, "digest": { "length": 311.0, "function_hash": "270275722975241669832619976181611758018" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2024-26598-cd06908f" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65b201bf3e9af1b0254243a5881390eda56f72d1", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c", "function": "vgic_its_check_cache" }, "digest": { "length": 311.0, "function_hash": "270275722975241669832619976181611758018" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2024-26598-db0d538a" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd3956a1b3dd11f46488c928cb890d6937d1ca80", "signature_version": "v1", "target": { "file": "arch/arm64/kvm/vgic/vgic-its.c", "function": "vgic_its_inject_cached_translation" }, "digest": { "length": 380.0, "function_hash": "96877720148768009557046411371422861818" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2024-26598-e58cc087" } ]