In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgicitscheckcache() does not elevate the refcount on the vgicirq before dropping the lock that serializes refcount changes.
Have vgicitscheckcache() raise the refcount on the returned vgicirq and add the corresponding decrement after queueing the interrupt.
[
{
"id": "CVE-2024-26598-048668e2",
"target": {
"function": "vgic_its_check_cache",
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd3956a1b3dd11f46488c928cb890d6937d1ca80",
"signature_type": "Function",
"digest": {
"function_hash": "270275722975241669832619976181611758018",
"length": 311.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-0ad3c2c1",
"target": {
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad362fe07fecf0aba839ff2cc59a3617bd42c33f",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310567826171508659484627165291753971134",
"249555805787144725702720374496208452404",
"162850934150674545887192199773214784059",
"27628539130590181192552898767302328546",
"310446865867122917342897301810556489418",
"128576463119609286898045492747998034863",
"70884871080497289231615493121931832234",
"48584523849434757844197225332288018536",
"167243345287186145739098519955665565393"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-1e18c4b8",
"target": {
"function": "vgic_its_check_cache",
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba7be666740847d967822bed15500656b26bc703",
"signature_type": "Function",
"digest": {
"function_hash": "270275722975241669832619976181611758018",
"length": 311.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-208d6365",
"target": {
"function": "vgic_its_inject_cached_translation",
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65b201bf3e9af1b0254243a5881390eda56f72d1",
"signature_type": "Function",
"digest": {
"function_hash": "96877720148768009557046411371422861818",
"length": 380.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-219a00d2",
"target": {
"function": "vgic_its_inject_cached_translation",
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dba788e25f05209adf2b0175eb1691dc89fb1ba6",
"signature_type": "Function",
"digest": {
"function_hash": "96877720148768009557046411371422861818",
"length": 380.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-274051b6",
"target": {
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dba788e25f05209adf2b0175eb1691dc89fb1ba6",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310567826171508659484627165291753971134",
"249555805787144725702720374496208452404",
"162850934150674545887192199773214784059",
"27628539130590181192552898767302328546",
"310446865867122917342897301810556489418",
"128576463119609286898045492747998034863",
"70884871080497289231615493121931832234",
"48584523849434757844197225332288018536",
"167243345287186145739098519955665565393"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-2744c27b",
"target": {
"function": "vgic_its_check_cache",
"file": "virt/kvm/arm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d04acadb6490aa3314f9c9e087691e55de153b88",
"signature_type": "Function",
"digest": {
"function_hash": "270275722975241669832619976181611758018",
"length": 311.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-29e1d930",
"target": {
"function": "vgic_its_check_cache",
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12c2759ab1343c124ed46ba48f27bd1ef5d2dff4",
"signature_type": "Function",
"digest": {
"function_hash": "270275722975241669832619976181611758018",
"length": 311.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-373a13a5",
"target": {
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65b201bf3e9af1b0254243a5881390eda56f72d1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310567826171508659484627165291753971134",
"249555805787144725702720374496208452404",
"162850934150674545887192199773214784059",
"27628539130590181192552898767302328546",
"310446865867122917342897301810556489418",
"128576463119609286898045492747998034863",
"70884871080497289231615493121931832234",
"48584523849434757844197225332288018536",
"167243345287186145739098519955665565393"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-512c6916",
"target": {
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd3956a1b3dd11f46488c928cb890d6937d1ca80",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310567826171508659484627165291753971134",
"249555805787144725702720374496208452404",
"162850934150674545887192199773214784059",
"27628539130590181192552898767302328546",
"310446865867122917342897301810556489418",
"128576463119609286898045492747998034863",
"70884871080497289231615493121931832234",
"48584523849434757844197225332288018536",
"167243345287186145739098519955665565393"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-744bb35f",
"target": {
"function": "vgic_its_inject_cached_translation",
"file": "virt/kvm/arm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d04acadb6490aa3314f9c9e087691e55de153b88",
"signature_type": "Function",
"digest": {
"function_hash": "271608768076818588605898993831336368395",
"length": 370.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-77bd8ca2",
"target": {
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12c2759ab1343c124ed46ba48f27bd1ef5d2dff4",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310567826171508659484627165291753971134",
"249555805787144725702720374496208452404",
"162850934150674545887192199773214784059",
"27628539130590181192552898767302328546",
"310446865867122917342897301810556489418",
"128576463119609286898045492747998034863",
"70884871080497289231615493121931832234",
"48584523849434757844197225332288018536",
"167243345287186145739098519955665565393"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-781e76d4",
"target": {
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba7be666740847d967822bed15500656b26bc703",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310567826171508659484627165291753971134",
"249555805787144725702720374496208452404",
"162850934150674545887192199773214784059",
"27628539130590181192552898767302328546",
"310446865867122917342897301810556489418",
"128576463119609286898045492747998034863",
"70884871080497289231615493121931832234",
"48584523849434757844197225332288018536",
"167243345287186145739098519955665565393"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-7fa6925e",
"target": {
"function": "vgic_its_inject_cached_translation",
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba7be666740847d967822bed15500656b26bc703",
"signature_type": "Function",
"digest": {
"function_hash": "96877720148768009557046411371422861818",
"length": 380.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-aa39d451",
"target": {
"function": "vgic_its_inject_cached_translation",
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad362fe07fecf0aba839ff2cc59a3617bd42c33f",
"signature_type": "Function",
"digest": {
"function_hash": "96877720148768009557046411371422861818",
"length": 380.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-afb0e2e1",
"target": {
"function": "vgic_its_check_cache",
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad362fe07fecf0aba839ff2cc59a3617bd42c33f",
"signature_type": "Function",
"digest": {
"function_hash": "270275722975241669832619976181611758018",
"length": 311.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-bd3212e9",
"target": {
"function": "vgic_its_inject_cached_translation",
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12c2759ab1343c124ed46ba48f27bd1ef5d2dff4",
"signature_type": "Function",
"digest": {
"function_hash": "96877720148768009557046411371422861818",
"length": 380.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-cd06908f",
"target": {
"function": "vgic_its_check_cache",
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dba788e25f05209adf2b0175eb1691dc89fb1ba6",
"signature_type": "Function",
"digest": {
"function_hash": "270275722975241669832619976181611758018",
"length": 311.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-db0d538a",
"target": {
"function": "vgic_its_check_cache",
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65b201bf3e9af1b0254243a5881390eda56f72d1",
"signature_type": "Function",
"digest": {
"function_hash": "270275722975241669832619976181611758018",
"length": 311.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-dddb57bc",
"target": {
"file": "virt/kvm/arm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d04acadb6490aa3314f9c9e087691e55de153b88",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310567826171508659484627165291753971134",
"249555805787144725702720374496208452404",
"162850934150674545887192199773214784059",
"27628539130590181192552898767302328546",
"310446865867122917342897301810556489418",
"182402586396804287184695215168780499311",
"70884871080497289231615493121931832234",
"48584523849434757844197225332288018536",
"167243345287186145739098519955665565393"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2024-26598-e58cc087",
"target": {
"function": "vgic_its_inject_cached_translation",
"file": "arch/arm64/kvm/vgic/vgic-its.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd3956a1b3dd11f46488c928cb890d6937d1ca80",
"signature_type": "Function",
"digest": {
"function_hash": "96877720148768009557046411371422861818",
"length": 380.0
},
"deprecated": false,
"signature_version": "v1"
}
]