Description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache

There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes.

Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Linux	Linux	>= 6211753fdfd05af9e08f54c8d0ba3ee516034878, < d04acadb6490aa3314f9c9e087691e55de153b88; >= 6211753fdfd05af9e08f54c8d0ba3ee516034878, < ba7be666740847d967822bed15500656b26bc703; >= 6211753fdfd05af9e08f54c8d0ba3ee516034878, < 12c2759ab1343c124ed46ba48f27bd1ef5d2dff4; >= 6211753fdfd05af9e08f54c8d0ba3ee516034878, < dba788e25f05209adf2b0175eb1691dc89fb1ba6; >= 6211753fdfd05af9e08f54c8d0ba3ee516034878, < 65b201bf3e9af1b0254243a5881390eda56f72d1; >= 6211753fdfd05af9e08f54c8d0ba3ee516034878, < dd3956a1b3dd11f46488c928cb890d6937d1ca80; >= 6211753fdfd05af9e08f54c8d0ba3ee516034878, < ad362fe07fecf0aba839ff2cc59a3617bd42c33f
Linux	Linux	3.11
linux	linux_kernel	>= 1da177e4c3f4, < d04acadb6490; >= 1da177e4c3f4, < ba7be6667408; >= 1da177e4c3f4, < 12c2759ab134; >= 1da177e4c3f4, < dba788e25f05; >= 1da177e4c3f4, < 65b201bf3e9a; >= 1da177e4c3f4, < dd3956a1b3dd; >= 1da177e4c3f4, < ad362fe07fec

References

Timeline

Published: Feb 23, 2024
Last modified: Aug 4, 2026
NVD status: Modified

CVE-2024-26598