KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 7.2.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID vgic_v2_deactivate() passes the INTID a guest wrote to GICV_DIR straight to vgic_get_vcpu_irq(), and treats a failed lookup as a "can't happen" condition with WARN_ON_ONCE(). The guest can make it happen at will, though: for any INTID outside of the implemented SGI, PPI and SPI ranges the lookup returns NULL, since GICv2 has no LPIs. A guest running with EOImode==1 writing such an INTID to GICV_DIR triggers the WARN, and panics hosts running with panic_on_warn. Drop the WARN and ignore failed lookups.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 255de897e7fb918a34845167c572b5bf8e1d9d79 · fixed in 78b95c571d021391153a5ac7981e9e4d5cc856a3; From 255de897e7fb918a34845167c572b5bf8e1d9d79 · fixed in c6d9c8ac6521d3049ec90ac58bebd23ed03ac496
- Linux Linux
6.19
- KernelLinux
From 6.19.0 · fixed in 7.2.4