CVE-2024-35791

Summary

In the Linux kernel, the following vulnerability has been resolved:

KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()

Do the cache flush of converted pages in svm_register_enc_region() before dropping kvm->lock to fix use-after-free issues where region and/or its array of pages could be freed by a different task, e.g. if userspace has __unregister_enc_region_locked() already queued up for the region.

Note, the "obvious" alternative of using local variables doesn't fully resolve the bug, as region->pages is also dynamically allocated. I.e. the region structure itself would be fine, but region->pages could be freed.

Flushing multiple pages under kvm->lock is unfortunate, but the entire flow is a rare slow path, and the manual flush is only needed on CPUs that lack coherency for encrypted memory.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux4f627ecde7329e476a077bb0590db8f27bb8f912 < 2d13b79640b147bd77c34a5998533b2021a4122daffected
LinuxLinux19a23da53932bc8011220bd8c410cb76012de004 < e126b508ed2e616d679d85fca2fbe77bb48bbdd7affected
LinuxLinux19a23da53932bc8011220bd8c410cb76012de004 < 4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865affected
LinuxLinux19a23da53932bc8011220bd8c410cb76012de004 < 12f8e32a5a389a5d58afc67728c76e61beee1ad4affected
LinuxLinux19a23da53932bc8011220bd8c410cb76012de004 < f6d53d8a2617dd58c89171a6b9610c470ebda38aaffected
LinuxLinux19a23da53932bc8011220bd8c410cb76012de004 < 5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807affected
LinuxLinuxf1ecde00ce1694597f923f0d25f7a797c5243d99affected
LinuxLinux848bcb0a1d96f67d075465667d3a1ad4af56311eaffected
LinuxLinux5.10.15 < 5.10.215affected
LinuxLinux4.19.176 < 4.20affected
LinuxLinux5.4.98 < 5.5affected
LinuxLinux5.11affected
LinuxLinux0 < 5.11unaffected
LinuxLinux5.10.215 <= 5.10.*unaffected
LinuxLinux5.15.154 <= 5.15.*unaffected
LinuxLinux6.1.84 <= 6.1.*unaffected
LinuxLinux6.6.24 <= 6.6.*unaffected
LinuxLinux6.7.12 <= 6.7.*unaffected
LinuxLinux6.8 <= *unaffected

Weaknesses

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References