In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Make ICC*SGI*EL1 undef in the absence of a vGICv3
On a system with a GICv3, if a guest hasn't been configured with GICv3 and that the host is not capable of GICv2 emulation, a write to any of the ICC*SGI*EL1 registers is trapped to EL2.
We therefore try to emulate the SGI access, only to hit a NULL pointer as no private interrupt is allocated (no GIC, remember?).
The obvious fix is to give the guest what it deserves, in the shape of a UNDEF exception.
[
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/sys_regs.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2073132f6ed3079369e857a8deb33d11bdd983bc",
"digest": {
"line_hashes": [
"273564496415231710053211187707956165550",
"58481554856832252561204972122768136007",
"32628143546116558206957825670019826312",
"94770720900277395408554480161417133055",
"118399541402168175096687518341096758754",
"47637209911078294504913943977337657569",
"338418966284749922019044734835958426224"
],
"threshold": 0.9
},
"id": "CVE-2024-46707-057fb2f6"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/sys_regs.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96b076e8ee5bc3a1126848c8add0f74bd30dc9d1",
"digest": {
"line_hashes": [
"273564496415231710053211187707956165550",
"58481554856832252561204972122768136007",
"137896824058286473533605156382118423063",
"145400314924184209269353665670808417784",
"118399541402168175096687518341096758754",
"47637209911078294504913943977337657569",
"338418966284749922019044734835958426224"
],
"threshold": 0.9
},
"id": "CVE-2024-46707-185954f3"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/sys_regs.c",
"function": "access_gic_sgi"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2073132f6ed3079369e857a8deb33d11bdd983bc",
"digest": {
"length": 477.0,
"function_hash": "135967763791365672509789873617302219842"
},
"id": "CVE-2024-46707-2ec0cc5a"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/vgic/vgic.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94d4fbad01b19ec5eab3d6b50aaec4f9db8b2d8d",
"digest": {
"line_hashes": [
"30409287049315908949241698618645750784"
],
"threshold": 0.9
},
"id": "CVE-2024-46707-3db3cbf4"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/sys_regs.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e6245ebe7ef341639e9a7e402b3ade8ad45a19f",
"digest": {
"line_hashes": [
"273564496415231710053211187707956165550",
"58481554856832252561204972122768136007",
"32628143546116558206957825670019826312",
"94770720900277395408554480161417133055",
"118399541402168175096687518341096758754",
"47637209911078294504913943977337657569",
"338418966284749922019044734835958426224"
],
"threshold": 0.9
},
"id": "CVE-2024-46707-3eb8b57f"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/vgic/vgic.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96b076e8ee5bc3a1126848c8add0f74bd30dc9d1",
"digest": {
"line_hashes": [
"30409287049315908949241698618645750784"
],
"threshold": 0.9
},
"id": "CVE-2024-46707-46fba613"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/sys_regs.c",
"function": "access_gic_sgi"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d7629bec5c3f80bd0e3bf8103c06a2f7046bd92",
"digest": {
"length": 477.0,
"function_hash": "135967763791365672509789873617302219842"
},
"id": "CVE-2024-46707-58567e6e"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/sys_regs.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94d4fbad01b19ec5eab3d6b50aaec4f9db8b2d8d",
"digest": {
"line_hashes": [
"273564496415231710053211187707956165550",
"58481554856832252561204972122768136007",
"32628143546116558206957825670019826312",
"34492788508400149310912022696077592902",
"118399541402168175096687518341096758754",
"47637209911078294504913943977337657569",
"338418966284749922019044734835958426224"
],
"threshold": 0.9
},
"id": "CVE-2024-46707-92652dbf"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/sys_regs.c",
"function": "access_gic_sgi"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e6245ebe7ef341639e9a7e402b3ade8ad45a19f",
"digest": {
"length": 477.0,
"function_hash": "135967763791365672509789873617302219842"
},
"id": "CVE-2024-46707-96b06bb7"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/vgic/vgic.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15818af2f7aa55eff375333cb7689df15d3f24ef",
"digest": {
"line_hashes": [
"164085819514999046797499235425145719302"
],
"threshold": 0.9
},
"id": "CVE-2024-46707-a594dc94"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/vgic/vgic.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2073132f6ed3079369e857a8deb33d11bdd983bc",
"digest": {
"line_hashes": [
"30409287049315908949241698618645750784"
],
"threshold": 0.9
},
"id": "CVE-2024-46707-a5db154c"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/sys_regs.c",
"function": "access_gic_sgi"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96b076e8ee5bc3a1126848c8add0f74bd30dc9d1",
"digest": {
"length": 477.0,
"function_hash": "135967763791365672509789873617302219842"
},
"id": "CVE-2024-46707-a930dc5e"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/sys_regs.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15818af2f7aa55eff375333cb7689df15d3f24ef",
"digest": {
"line_hashes": [
"273564496415231710053211187707956165550",
"58481554856832252561204972122768136007",
"137896824058286473533605156382118423063",
"145400314924184209269353665670808417784",
"118399541402168175096687518341096758754",
"47637209911078294504913943977337657569",
"103963019082681367768670887435563358420"
],
"threshold": 0.9
},
"id": "CVE-2024-46707-ac86c71b"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/sys_regs.c"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d7629bec5c3f80bd0e3bf8103c06a2f7046bd92",
"digest": {
"line_hashes": [
"273564496415231710053211187707956165550",
"58481554856832252561204972122768136007",
"32628143546116558206957825670019826312",
"94770720900277395408554480161417133055",
"118399541402168175096687518341096758754",
"47637209911078294504913943977337657569",
"338418966284749922019044734835958426224"
],
"threshold": 0.9
},
"id": "CVE-2024-46707-baaff88a"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/vgic/vgic.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9d7629bec5c3f80bd0e3bf8103c06a2f7046bd92",
"digest": {
"line_hashes": [
"30409287049315908949241698618645750784"
],
"threshold": 0.9
},
"id": "CVE-2024-46707-be340280"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/sys_regs.c",
"function": "access_gic_sgi"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94d4fbad01b19ec5eab3d6b50aaec4f9db8b2d8d",
"digest": {
"length": 477.0,
"function_hash": "135967763791365672509789873617302219842"
},
"id": "CVE-2024-46707-efa1f97c"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/vgic/vgic.h"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e6245ebe7ef341639e9a7e402b3ade8ad45a19f",
"digest": {
"line_hashes": [
"30409287049315908949241698618645750784"
],
"threshold": 0.9
},
"id": "CVE-2024-46707-f115ca04"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "arch/arm64/kvm/sys_regs.c",
"function": "access_gic_sgi"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15818af2f7aa55eff375333cb7689df15d3f24ef",
"digest": {
"length": 479.0,
"function_hash": "273859914070943567504451246645210816806"
},
"id": "CVE-2024-46707-f89a37f7"
}
]