Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2024-44948

x86/mtrr: Check if fixed MTRRs exist before saving them

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 4.19.320, 5.4.282, 5.10.224, 5.15.165, 6.1.105, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: x86/mtrr: Check if fixed MTRRs exist before saving them MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed variant has a separate capability bit in the MTRR capability MSR. So far all x86 CPUs which support MTRR have this separate bit set, so it went unnoticed that mtrr_save_state() does not check the capability bit before accessing the fixed MTRR MSRs. Though on a CPU that does not support the fixed MTRR capability this results in a #GP. The #GP itself is harmless because the RDMSR fault is handled gracefully, but results in a WARN_ON(). Add the missing capability check to prevent this.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From 2b1f6278d77c1f2f669346fc2bb48012b5e9495a · fixed in 34f36e6ee5bd7eff8b2adcd9fcaef369f752d82e; From 2b1f6278d77c1f2f669346fc2bb48012b5e9495a · fixed in 06c1de44d378ec5439db17bf476507d68589bfe9; From 2b1f6278d77c1f2f669346fc2bb48012b5e9495a · fixed in 450b6b22acdaac67a18eaf5ed498421ffcf10051; From 2b1f6278d77c1f2f669346fc2bb48012b5e9495a · fixed in ca7d00c5656d1791e28369919e3e10febe9c3b16; From 2b1f6278d77c1f2f669346fc2bb48012b5e9495a · fixed in 8aa79dfb216b865e96ff890bc4ea71650f9bc8d7; From 2b1f6278d77c1f2f669346fc2bb48012b5e9495a · fixed in 8a90d3fc7c24608548d3a750671f9dac21d1a462; From 2b1f6278d77c1f2f669346fc2bb48012b5e9495a · fixed in 388f1c954019f253a8383f7eb733f38d541e10b6; From 2b1f6278d77c1f2f669346fc2bb48012b5e9495a · fixed in 919f18f961c03d6694aa726c514184f2311a4614

  • Linux Linux

    2.6.22

  • KernelLinux

    From 2.6.22 · fixed in 4.19.320; From 4.20.0 · fixed in 5.4.282; From 5.5.0 · fixed in 5.10.224; From 5.11.0 · fixed in 5.15.165; From 5.16.0 · fixed in 6.1.105; From 6.2.0 · fixed in 6.6.46; From 6.7.0 · fixed in 6.10.5

References 8

git.kernel.org