LoongArch: KVM: Validate MSI data before routing it to EIOINTC
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.18.57, 7.2.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Validate MSI data before routing it to EIOINTC pch_msi_set_irq() passes e->msi.data straight into eiointc_set_irq() as the irq number. The MSI data comes from userspace, that either via a KVM_IRQ_ROUTING_MSI entry set with KVM_SET_GSI_ROUTING (used by irqfd and KVM_IRQ_LINE) or directly via KVM_SIGNAL_MSI, and is never checked against EIOINTC_IRQS. eiointc_set_irq() uses the value with __set_bit()/__clear_bit() on the 256-bit isr bitmap, eiointc_update_irq() then indexes sw_coremap[] and the per-cpu coreisr/sw_coreisr bitmaps with it. Therefore a data value >= 256 reads and writes memory past the end of those arrays, i.e. any process holding a VM fd can corrupt kernel memory beyond the allocation of loongarch_eiointc. Reject MSI data that doesn't fit in the EIOINTC irq space. The DMSINTC path is unaffected as it decodes the vector from the address and masks it.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 1928254c5ccb7bdffd7f0334e1ce250e9ce4de94 · fixed in 506f03b5f869cbae50d31b50d80d4a5735d47f94; From 1928254c5ccb7bdffd7f0334e1ce250e9ce4de94 · fixed in 83715a40a2d30d23719e0b25380ba82ff905195b; From 1928254c5ccb7bdffd7f0334e1ce250e9ce4de94 · fixed in 501514d6ebd2111c353a1296f25dbe22fbd64657
- Linux Linux
6.13
- KernelLinux
From 6.13.0 · fixed in 6.18.57; From 6.19.0 · fixed in 7.2.5