In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Flush pages under kvm->lock to fix UAF in svmregisterenc_region()
Do the cache flush of converted pages in svmregisterencregion() before dropping kvm->lock to fix use-after-free issues where region and/or its array of pages could be freed by a different task, e.g. if userspace has _unregisterencregion_locked() already queued up for the region.
Note, the "obvious" alternative of using local variables doesn't fully resolve the bug, as region->pages is also dynamically allocated. I.e. the region structure itself would be fine, but region->pages could be freed.
Flushing multiple pages under kvm->lock is unfortunate, but the entire flow is a rare slow path, and the manual flush is only needed on CPUs that lack coherency for encrypted memory.
[
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c",
"function": "sev_mem_enc_register_region"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865",
"digest": {
"length": 871.0,
"function_hash": "34117091534823587441612840727440429909"
},
"id": "CVE-2024-35791-0a1cb09d"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865",
"digest": {
"line_hashes": [
"263816931461026815601687541744909426528",
"287453695515527866221251770169964882177",
"326642812391388800233164387176178552373",
"140388130507549386982317500729232806425",
"189904685349981167031623357478185583513",
"83256363944502943393981878028577796736",
"139455535948842516663740329932502085507",
"35751556705548854350645935838291686685"
],
"threshold": 0.9
},
"id": "CVE-2024-35791-249b8ccf"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e126b508ed2e616d679d85fca2fbe77bb48bbdd7",
"digest": {
"line_hashes": [
"263816931461026815601687541744909426528",
"287453695515527866221251770169964882177",
"326642812391388800233164387176178552373",
"140388130507549386982317500729232806425",
"189904685349981167031623357478185583513",
"83256363944502943393981878028577796736",
"139455535948842516663740329932502085507",
"35751556705548854350645935838291686685"
],
"threshold": 0.9
},
"id": "CVE-2024-35791-9a5bc20a"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c",
"function": "svm_register_enc_region"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d13b79640b147bd77c34a5998533b2021a4122d",
"digest": {
"length": 827.0,
"function_hash": "315895499894791046845284250368100839496"
},
"id": "CVE-2024-35791-a3f1e94f"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c",
"function": "svm_register_enc_region"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e126b508ed2e616d679d85fca2fbe77bb48bbdd7",
"digest": {
"length": 871.0,
"function_hash": "34117091534823587441612840727440429909"
},
"id": "CVE-2024-35791-e05e407b"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d13b79640b147bd77c34a5998533b2021a4122d",
"digest": {
"line_hashes": [
"263816931461026815601687541744909426528",
"287453695515527866221251770169964882177",
"326642812391388800233164387176178552373",
"140388130507549386982317500729232806425",
"189904685349981167031623357478185583513",
"83256363944502943393981878028577796736",
"139455535948842516663740329932502085507",
"35751556705548854350645935838291686685"
],
"threshold": 0.9
},
"id": "CVE-2024-35791-e61b51a2"
}
]