CVE-2024-53195 (GCVE-0-2024-53195)

Vulnerability from cvelistv5 – Published: 2024-12-27 13:49 – Updated: 2026-05-11 20:52
VLAI
Title
KVM: arm64: Get rid of userspace_irqchip_in_use
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Get rid of userspace_irqchip_in_use Improper use of userspace_irqchip_in_use led to syzbot hitting the following WARN_ON() in kvm_timer_update_irq(): WARNING: CPU: 0 PID: 3281 at arch/arm64/kvm/arch_timer.c:459 kvm_timer_update_irq+0x21c/0x394 Call trace: kvm_timer_update_irq+0x21c/0x394 arch/arm64/kvm/arch_timer.c:459 kvm_timer_vcpu_reset+0x158/0x684 arch/arm64/kvm/arch_timer.c:968 kvm_reset_vcpu+0x3b4/0x560 arch/arm64/kvm/reset.c:264 kvm_vcpu_set_target arch/arm64/kvm/arm.c:1553 [inline] kvm_arch_vcpu_ioctl_vcpu_init arch/arm64/kvm/arm.c:1573 [inline] kvm_arch_vcpu_ioctl+0x112c/0x1b3c arch/arm64/kvm/arm.c:1695 kvm_vcpu_ioctl+0x4ec/0xf74 virt/kvm/kvm_main.c:4658 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __arm64_sys_ioctl+0x108/0x184 fs/ioctl.c:893 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x78/0x1b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x1b0 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x40/0x50 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 The following sequence led to the scenario: - Userspace creates a VM and a vCPU. - The vCPU is initialized with KVM_ARM_VCPU_PMU_V3 during KVM_ARM_VCPU_INIT. - Without any other setup, such as vGIC or vPMU, userspace issues KVM_RUN on the vCPU. Since the vPMU is requested, but not setup, kvm_arm_pmu_v3_enable() fails in kvm_arch_vcpu_run_pid_change(). As a result, KVM_RUN returns after enabling the timer, but before incrementing 'userspace_irqchip_in_use': kvm_arch_vcpu_run_pid_change() ret = kvm_arm_pmu_v3_enable() if (!vcpu->arch.pmu.created) return -EINVAL; if (ret) return ret; [...] if (!irqchip_in_kernel(kvm)) static_branch_inc(&userspace_irqchip_in_use); - Userspace ignores the error and issues KVM_ARM_VCPU_INIT again. Since the timer is already enabled, control moves through the following flow, ultimately hitting the WARN_ON(): kvm_timer_vcpu_reset() if (timer->enabled) kvm_timer_update_irq() if (!userspace_irqchip()) ret = kvm_vgic_inject_irq() ret = vgic_lazy_init() if (unlikely(!vgic_initialized(kvm))) if (kvm->arch.vgic.vgic_model != KVM_DEV_TYPE_ARM_VGIC_V2) return -EBUSY; WARN_ON(ret); Theoretically, since userspace_irqchip_in_use's functionality can be simply replaced by '!irqchip_in_kernel()', get rid of the static key to avoid the mismanagement, which also helps with the syzbot issue.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 6211753fdfd05af9e08f54c8d0ba3ee516034878 , < dd2f9861f27571d47998d71e7516bf7216db0b52 (git)
Affected: 6211753fdfd05af9e08f54c8d0ba3ee516034878 , < c16e2dba39ff6ae84bb8dc9c8e0fb21d9b2f6f5c (git)
Affected: 6211753fdfd05af9e08f54c8d0ba3ee516034878 , < fe425d5239a28c21e0c83ee7a8f4cb210d29fdb4 (git)
Affected: 6211753fdfd05af9e08f54c8d0ba3ee516034878 , < 38d7aacca09230fdb98a34194fec2af597e8e20d (git)
Create a notification for this product.
Linux Linux Affected: 3.11
Unaffected: 0 , < 3.11 (semver)
Unaffected: 6.6.64 , ≤ 6.6.* (semver)
Unaffected: 6.11.11 , ≤ 6.11.* (semver)
Unaffected: 6.12.2 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kvm_host.h",
            "arch/arm64/kvm/arch_timer.c",
            "arch/arm64/kvm/arm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dd2f9861f27571d47998d71e7516bf7216db0b52",
              "status": "affected",
              "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
              "versionType": "git"
            },
            {
              "lessThan": "c16e2dba39ff6ae84bb8dc9c8e0fb21d9b2f6f5c",
              "status": "affected",
              "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
              "versionType": "git"
            },
            {
              "lessThan": "fe425d5239a28c21e0c83ee7a8f4cb210d29fdb4",
              "status": "affected",
              "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
              "versionType": "git"
            },
            {
              "lessThan": "38d7aacca09230fdb98a34194fec2af597e8e20d",
              "status": "affected",
              "version": "6211753fdfd05af9e08f54c8d0ba3ee516034878",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/kvm_host.h",
            "arch/arm64/kvm/arch_timer.c",
            "arch/arm64/kvm/arm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.64",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Get rid of userspace_irqchip_in_use\n\nImproper use of userspace_irqchip_in_use led to syzbot hitting the\nfollowing WARN_ON() in kvm_timer_update_irq():\n\nWARNING: CPU: 0 PID: 3281 at arch/arm64/kvm/arch_timer.c:459\nkvm_timer_update_irq+0x21c/0x394\nCall trace:\n  kvm_timer_update_irq+0x21c/0x394 arch/arm64/kvm/arch_timer.c:459\n  kvm_timer_vcpu_reset+0x158/0x684 arch/arm64/kvm/arch_timer.c:968\n  kvm_reset_vcpu+0x3b4/0x560 arch/arm64/kvm/reset.c:264\n  kvm_vcpu_set_target arch/arm64/kvm/arm.c:1553 [inline]\n  kvm_arch_vcpu_ioctl_vcpu_init arch/arm64/kvm/arm.c:1573 [inline]\n  kvm_arch_vcpu_ioctl+0x112c/0x1b3c arch/arm64/kvm/arm.c:1695\n  kvm_vcpu_ioctl+0x4ec/0xf74 virt/kvm/kvm_main.c:4658\n  vfs_ioctl fs/ioctl.c:51 [inline]\n  __do_sys_ioctl fs/ioctl.c:907 [inline]\n  __se_sys_ioctl fs/ioctl.c:893 [inline]\n  __arm64_sys_ioctl+0x108/0x184 fs/ioctl.c:893\n  __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n  invoke_syscall+0x78/0x1b8 arch/arm64/kernel/syscall.c:49\n  el0_svc_common+0xe8/0x1b0 arch/arm64/kernel/syscall.c:132\n  do_el0_svc+0x40/0x50 arch/arm64/kernel/syscall.c:151\n  el0_svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712\n  el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730\n  el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598\n\nThe following sequence led to the scenario:\n - Userspace creates a VM and a vCPU.\n - The vCPU is initialized with KVM_ARM_VCPU_PMU_V3 during\n   KVM_ARM_VCPU_INIT.\n - Without any other setup, such as vGIC or vPMU, userspace issues\n   KVM_RUN on the vCPU. Since the vPMU is requested, but not setup,\n   kvm_arm_pmu_v3_enable() fails in kvm_arch_vcpu_run_pid_change().\n   As a result, KVM_RUN returns after enabling the timer, but before\n   incrementing \u0027userspace_irqchip_in_use\u0027:\n   kvm_arch_vcpu_run_pid_change()\n       ret = kvm_arm_pmu_v3_enable()\n           if (!vcpu-\u003earch.pmu.created)\n               return -EINVAL;\n       if (ret)\n           return ret;\n       [...]\n       if (!irqchip_in_kernel(kvm))\n           static_branch_inc(\u0026userspace_irqchip_in_use);\n - Userspace ignores the error and issues KVM_ARM_VCPU_INIT again.\n   Since the timer is already enabled, control moves through the\n   following flow, ultimately hitting the WARN_ON():\n   kvm_timer_vcpu_reset()\n       if (timer-\u003eenabled)\n          kvm_timer_update_irq()\n              if (!userspace_irqchip())\n                  ret = kvm_vgic_inject_irq()\n                      ret = vgic_lazy_init()\n                          if (unlikely(!vgic_initialized(kvm)))\n                              if (kvm-\u003earch.vgic.vgic_model !=\n                                  KVM_DEV_TYPE_ARM_VGIC_V2)\n                                      return -EBUSY;\n                  WARN_ON(ret);\n\nTheoretically, since userspace_irqchip_in_use\u0027s functionality can be\nsimply replaced by \u0027!irqchip_in_kernel()\u0027, get rid of the static key\nto avoid the mismanagement, which also helps with the syzbot issue."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:52:40.934Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dd2f9861f27571d47998d71e7516bf7216db0b52"
        },
        {
          "url": "https://git.kernel.org/stable/c/c16e2dba39ff6ae84bb8dc9c8e0fb21d9b2f6f5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe425d5239a28c21e0c83ee7a8f4cb210d29fdb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/38d7aacca09230fdb98a34194fec2af597e8e20d"
        }
      ],
      "title": "KVM: arm64: Get rid of userspace_irqchip_in_use",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53195",
    "datePublished": "2024-12-27T13:49:37.514Z",
    "dateReserved": "2024-11-19T17:17:25.014Z",
    "dateUpdated": "2026-05-11T20:52:40.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-53195",
      "date": "2026-05-27",
      "epss": "9e-05",
      "percentile": "0.00885"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: arm64: Get rid of userspace_irqchip_in_use\\n\\nImproper use of userspace_irqchip_in_use led to syzbot hitting the\\nfollowing WARN_ON() in kvm_timer_update_irq():\\n\\nWARNING: CPU: 0 PID: 3281 at arch/arm64/kvm/arch_timer.c:459\\nkvm_timer_update_irq+0x21c/0x394\\nCall trace:\\n  kvm_timer_update_irq+0x21c/0x394 arch/arm64/kvm/arch_timer.c:459\\n  kvm_timer_vcpu_reset+0x158/0x684 arch/arm64/kvm/arch_timer.c:968\\n  kvm_reset_vcpu+0x3b4/0x560 arch/arm64/kvm/reset.c:264\\n  kvm_vcpu_set_target arch/arm64/kvm/arm.c:1553 [inline]\\n  kvm_arch_vcpu_ioctl_vcpu_init arch/arm64/kvm/arm.c:1573 [inline]\\n  kvm_arch_vcpu_ioctl+0x112c/0x1b3c arch/arm64/kvm/arm.c:1695\\n  kvm_vcpu_ioctl+0x4ec/0xf74 virt/kvm/kvm_main.c:4658\\n  vfs_ioctl fs/ioctl.c:51 [inline]\\n  __do_sys_ioctl fs/ioctl.c:907 [inline]\\n  __se_sys_ioctl fs/ioctl.c:893 [inline]\\n  __arm64_sys_ioctl+0x108/0x184 fs/ioctl.c:893\\n  __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\\n  invoke_syscall+0x78/0x1b8 arch/arm64/kernel/syscall.c:49\\n  el0_svc_common+0xe8/0x1b0 arch/arm64/kernel/syscall.c:132\\n  do_el0_svc+0x40/0x50 arch/arm64/kernel/syscall.c:151\\n  el0_svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712\\n  el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730\\n  el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598\\n\\nThe following sequence led to the scenario:\\n - Userspace creates a VM and a vCPU.\\n - The vCPU is initialized with KVM_ARM_VCPU_PMU_V3 during\\n   KVM_ARM_VCPU_INIT.\\n - Without any other setup, such as vGIC or vPMU, userspace issues\\n   KVM_RUN on the vCPU. Since the vPMU is requested, but not setup,\\n   kvm_arm_pmu_v3_enable() fails in kvm_arch_vcpu_run_pid_change().\\n   As a result, KVM_RUN returns after enabling the timer, but before\\n   incrementing \u0027userspace_irqchip_in_use\u0027:\\n   kvm_arch_vcpu_run_pid_change()\\n       ret = kvm_arm_pmu_v3_enable()\\n           if (!vcpu-\u003earch.pmu.created)\\n               return -EINVAL;\\n       if (ret)\\n           return ret;\\n       [...]\\n       if (!irqchip_in_kernel(kvm))\\n           static_branch_inc(\u0026userspace_irqchip_in_use);\\n - Userspace ignores the error and issues KVM_ARM_VCPU_INIT again.\\n   Since the timer is already enabled, control moves through the\\n   following flow, ultimately hitting the WARN_ON():\\n   kvm_timer_vcpu_reset()\\n       if (timer-\u003eenabled)\\n          kvm_timer_update_irq()\\n              if (!userspace_irqchip())\\n                  ret = kvm_vgic_inject_irq()\\n                      ret = vgic_lazy_init()\\n                          if (unlikely(!vgic_initialized(kvm)))\\n                              if (kvm-\u003earch.vgic.vgic_model !=\\n                                  KVM_DEV_TYPE_ARM_VGIC_V2)\\n                                      return -EBUSY;\\n                  WARN_ON(ret);\\n\\nTheoretically, since userspace_irqchip_in_use\u0027s functionality can be\\nsimply replaced by \u0027!irqchip_in_kernel()\u0027, get rid of the static key\\nto avoid the mismanagement, which also helps with the syzbot issue.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: arm64: deshacerse de userspace_irqchip_in_use El uso inadecuado de userspace_irqchip_in_use provoc\\u00f3 que syzbot ejecutara el siguiente WARN_ON() en kvm_timer_update_irq(): ADVERTENCIA: CPU: 0 PID: 3281 en arch/arm64/kvm/arch_timer.c:459 kvm_timer_update_irq+0x21c/0x394 Rastreo de llamadas: kvm_timer_update_irq+0x21c/0x394 arch/arm64/kvm/arch_timer.c:459 kvm_timer_vcpu_reset+0x158/0x684 arch/arm64/kvm/arch_timer.c:968 kvm_reset_vcpu+0x3b4/0x560 arch/arm64/kvm/reset.c:264 kvm_vcpu_set_target arch/arm64/kvm/arm.c:1553 [en l\\u00ednea] kvm_arch_vcpu_ioctl_vcpu_init arch/arm64/kvm/arm.c:1573 [en l\\u00ednea] kvm_arch_vcpu_ioctl+0x112c/0x1b3c arch/arm64/kvm/arm.c:1695 kvm_vcpu_ioctl+0x4ec/0xf74 virt/kvm/kvm_main.c:4658 vfs_ioctl fs/ioctl.c:51 [en l\\u00ednea] __do_sys_ioctl fs/ioctl.c:907 [en l\\u00ednea] __se_sys_ioctl fs/ioctl.c:893 [en l\\u00ednea] __arm64_sys_ioctl+0x108/0x184 fs/ioctl.c:893 __invoke_syscall arch/arm64/kernel/syscall.c:35 [en l\\u00ednea] anybody_syscall+0x78/0x1b8 another_syscall arch/arm64/kernel/syscall.c:49 another_svc_common+0xe8/0x1b0 another_syscall arch/arm64/kernel/syscall.c:132 another_svc+0x40/0x50 another_syscall arch/arm64/kernel/syscall.c:151 another_svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 La siguiente secuencia condujo al escenario: - El espacio de usuario crea una VM y una vCPU. - La vCPU se inicializa con KVM_ARM_VCPU_PMU_V3 durante KVM_ARM_VCPU_INIT. - Sin ninguna otra configuraci\\u00f3n, como vGIC o vPMU, el espacio de usuario emite KVM_RUN en la vCPU. Dado que se solicita la vPMU, pero no se configura, kvm_arm_pmu_v3_enable() falla en kvm_arch_vcpu_run_pid_change(). Como resultado, KVM_RUN regresa despu\\u00e9s de habilitar el temporizador, pero antes de incrementar \u0027userspace_irqchip_in_use\u0027: kvm_arch_vcpu_run_pid_change() ret = kvm_arm_pmu_v3_enable() if (!vcpu-\u0026gt;arch.pmu.created) return -EINVAL; if (ret) return ret; [...] if (!irqchip_in_kernel(kvm)) static_branch_inc(\u0026amp;userspace_irqchip_in_use); - Userspace ignora el error y emite KVM_ARM_VCPU_INIT nuevamente. Como el temporizador ya est\\u00e1 habilitado, el control se mueve a trav\\u00e9s del siguiente flujo, y finalmente llega a WARN_ON(): kvm_timer_vcpu_reset() if (timer-\u0026gt;enabled) kvm_timer_update_irq() if (!userspace_irqchip()) ret = kvm_vgic_inject_irq() ret = vgic_lazy_init() if (unlikely(!vgic_initialized(kvm))) if (kvm-\u0026gt;arch.vgic.vgic_model != KVM_DEV_TYPE_ARM_VGIC_V2) return -EBUSY; WARN_ON(ret); Te\\u00f3ricamente, dado que la funcionalidad de userspace_irqchip_in_use se puede reemplazar simplemente por \u0027!irqchip_in_kernel()\u0027, desh\\u00e1gase de la clave est\\u00e1tica para evitar la mala administraci\\u00f3n, lo que tambi\\u00e9n ayuda con el problema de syzbot.\"}]",
      "id": "CVE-2024-53195",
      "lastModified": "2024-12-27T14:15:27.137",
      "published": "2024-12-27T14:15:27.137",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/38d7aacca09230fdb98a34194fec2af597e8e20d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c16e2dba39ff6ae84bb8dc9c8e0fb21d9b2f6f5c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/dd2f9861f27571d47998d71e7516bf7216db0b52\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/fe425d5239a28c21e0c83ee7a8f4cb210d29fdb4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-53195\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T14:15:27.137\",\"lastModified\":\"2025-10-08T14:07:06.337\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: arm64: Get rid of userspace_irqchip_in_use\\n\\nImproper use of userspace_irqchip_in_use led to syzbot hitting the\\nfollowing WARN_ON() in kvm_timer_update_irq():\\n\\nWARNING: CPU: 0 PID: 3281 at arch/arm64/kvm/arch_timer.c:459\\nkvm_timer_update_irq+0x21c/0x394\\nCall trace:\\n  kvm_timer_update_irq+0x21c/0x394 arch/arm64/kvm/arch_timer.c:459\\n  kvm_timer_vcpu_reset+0x158/0x684 arch/arm64/kvm/arch_timer.c:968\\n  kvm_reset_vcpu+0x3b4/0x560 arch/arm64/kvm/reset.c:264\\n  kvm_vcpu_set_target arch/arm64/kvm/arm.c:1553 [inline]\\n  kvm_arch_vcpu_ioctl_vcpu_init arch/arm64/kvm/arm.c:1573 [inline]\\n  kvm_arch_vcpu_ioctl+0x112c/0x1b3c arch/arm64/kvm/arm.c:1695\\n  kvm_vcpu_ioctl+0x4ec/0xf74 virt/kvm/kvm_main.c:4658\\n  vfs_ioctl fs/ioctl.c:51 [inline]\\n  __do_sys_ioctl fs/ioctl.c:907 [inline]\\n  __se_sys_ioctl fs/ioctl.c:893 [inline]\\n  __arm64_sys_ioctl+0x108/0x184 fs/ioctl.c:893\\n  __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\\n  invoke_syscall+0x78/0x1b8 arch/arm64/kernel/syscall.c:49\\n  el0_svc_common+0xe8/0x1b0 arch/arm64/kernel/syscall.c:132\\n  do_el0_svc+0x40/0x50 arch/arm64/kernel/syscall.c:151\\n  el0_svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712\\n  el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730\\n  el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598\\n\\nThe following sequence led to the scenario:\\n - Userspace creates a VM and a vCPU.\\n - The vCPU is initialized with KVM_ARM_VCPU_PMU_V3 during\\n   KVM_ARM_VCPU_INIT.\\n - Without any other setup, such as vGIC or vPMU, userspace issues\\n   KVM_RUN on the vCPU. Since the vPMU is requested, but not setup,\\n   kvm_arm_pmu_v3_enable() fails in kvm_arch_vcpu_run_pid_change().\\n   As a result, KVM_RUN returns after enabling the timer, but before\\n   incrementing \u0027userspace_irqchip_in_use\u0027:\\n   kvm_arch_vcpu_run_pid_change()\\n       ret = kvm_arm_pmu_v3_enable()\\n           if (!vcpu-\u003earch.pmu.created)\\n               return -EINVAL;\\n       if (ret)\\n           return ret;\\n       [...]\\n       if (!irqchip_in_kernel(kvm))\\n           static_branch_inc(\u0026userspace_irqchip_in_use);\\n - Userspace ignores the error and issues KVM_ARM_VCPU_INIT again.\\n   Since the timer is already enabled, control moves through the\\n   following flow, ultimately hitting the WARN_ON():\\n   kvm_timer_vcpu_reset()\\n       if (timer-\u003eenabled)\\n          kvm_timer_update_irq()\\n              if (!userspace_irqchip())\\n                  ret = kvm_vgic_inject_irq()\\n                      ret = vgic_lazy_init()\\n                          if (unlikely(!vgic_initialized(kvm)))\\n                              if (kvm-\u003earch.vgic.vgic_model !=\\n                                  KVM_DEV_TYPE_ARM_VGIC_V2)\\n                                      return -EBUSY;\\n                  WARN_ON(ret);\\n\\nTheoretically, since userspace_irqchip_in_use\u0027s functionality can be\\nsimply replaced by \u0027!irqchip_in_kernel()\u0027, get rid of the static key\\nto avoid the mismanagement, which also helps with the syzbot issue.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: arm64: deshacerse de userspace_irqchip_in_use El uso inadecuado de userspace_irqchip_in_use provoc\u00f3 que syzbot ejecutara el siguiente WARN_ON() en kvm_timer_update_irq(): ADVERTENCIA: CPU: 0 PID: 3281 en arch/arm64/kvm/arch_timer.c:459 kvm_timer_update_irq+0x21c/0x394 Rastreo de llamadas: kvm_timer_update_irq+0x21c/0x394 arch/arm64/kvm/arch_timer.c:459 kvm_timer_vcpu_reset+0x158/0x684 arch/arm64/kvm/arch_timer.c:968 kvm_reset_vcpu+0x3b4/0x560 arch/arm64/kvm/reset.c:264 kvm_vcpu_set_target arch/arm64/kvm/arm.c:1553 [en l\u00ednea] kvm_arch_vcpu_ioctl_vcpu_init arch/arm64/kvm/arm.c:1573 [en l\u00ednea] kvm_arch_vcpu_ioctl+0x112c/0x1b3c arch/arm64/kvm/arm.c:1695 kvm_vcpu_ioctl+0x4ec/0xf74 virt/kvm/kvm_main.c:4658 vfs_ioctl fs/ioctl.c:51 [en l\u00ednea] __do_sys_ioctl fs/ioctl.c:907 [en l\u00ednea] __se_sys_ioctl fs/ioctl.c:893 [en l\u00ednea] __arm64_sys_ioctl+0x108/0x184 fs/ioctl.c:893 __invoke_syscall arch/arm64/kernel/syscall.c:35 [en l\u00ednea] anybody_syscall+0x78/0x1b8 another_syscall arch/arm64/kernel/syscall.c:49 another_svc_common+0xe8/0x1b0 another_syscall arch/arm64/kernel/syscall.c:132 another_svc+0x40/0x50 another_syscall arch/arm64/kernel/syscall.c:151 another_svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 La siguiente secuencia condujo al escenario: - El espacio de usuario crea una VM y una vCPU. - La vCPU se inicializa con KVM_ARM_VCPU_PMU_V3 durante KVM_ARM_VCPU_INIT. - Sin ninguna otra configuraci\u00f3n, como vGIC o vPMU, el espacio de usuario emite KVM_RUN en la vCPU. Dado que se solicita la vPMU, pero no se configura, kvm_arm_pmu_v3_enable() falla en kvm_arch_vcpu_run_pid_change(). Como resultado, KVM_RUN regresa despu\u00e9s de habilitar el temporizador, pero antes de incrementar \u0027userspace_irqchip_in_use\u0027: kvm_arch_vcpu_run_pid_change() ret = kvm_arm_pmu_v3_enable() if (!vcpu-\u0026gt;arch.pmu.created) return -EINVAL; if (ret) return ret; [...] if (!irqchip_in_kernel(kvm)) static_branch_inc(\u0026amp;userspace_irqchip_in_use); - Userspace ignora el error y emite KVM_ARM_VCPU_INIT nuevamente. Como el temporizador ya est\u00e1 habilitado, el control se mueve a trav\u00e9s del siguiente flujo, y finalmente llega a WARN_ON(): kvm_timer_vcpu_reset() if (timer-\u0026gt;enabled) kvm_timer_update_irq() if (!userspace_irqchip()) ret = kvm_vgic_inject_irq() ret = vgic_lazy_init() if (unlikely(!vgic_initialized(kvm))) if (kvm-\u0026gt;arch.vgic.vgic_model != KVM_DEV_TYPE_ARM_VGIC_V2) return -EBUSY; WARN_ON(ret); Te\u00f3ricamente, dado que la funcionalidad de userspace_irqchip_in_use se puede reemplazar simplemente por \u0027!irqchip_in_kernel()\u0027, desh\u00e1gase de la clave est\u00e1tica para evitar la mala administraci\u00f3n, lo que tambi\u00e9n ayuda con el problema de syzbot.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.6.64\",\"matchCriteriaId\":\"523573B1-32B0-4CEF-A666-DC2DA3D85104\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.11\",\"matchCriteriaId\":\"21434379-192D-472F-9B54-D45E3650E893\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.2\",\"matchCriteriaId\":\"D8882B1B-2ABC-4838-AC1D-DBDBB5764776\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/38d7aacca09230fdb98a34194fec2af597e8e20d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c16e2dba39ff6ae84bb8dc9c8e0fb21d9b2f6f5c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dd2f9861f27571d47998d71e7516bf7216db0b52\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fe425d5239a28c21e0c83ee7a8f4cb210d29fdb4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.