Executive brief
A vulnerability in the Linux kernel's VFIO PCI driver could allow a local user to cause a system crash. The VFIO component is used to give virtual machines direct access to hardware devices like network cards or GPUs. An attacker could exploit this flaw to trigger a 'null pointer dereference,' leading to a kernel panic and a total denial of service for the host system.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel's vfio/pci driver (specifically in the INTx interrupt handling logic). The vulnerability occurs because the eventfd for INTx signaling can be deconfigured, unregistering the IRQ handler while still allowing eventfds to be signaled with a NULL context via the SET_IRQS ioctl or unmask irqfd if a device interrupt is pending. This is primarily due to a race condition where the irqfd path runs asynchronously to the ioctl and config space accesses, and the igate mutex cannot be acquired from the atomic context of the eventfd wake function. Attackers with local access can exploit this to trigger a kernel panic. The fix involves making the INTx handler persistent to track the lifetime of the INTx context object rather than the registration of a specific trigger eventfd.
Affected products
- Linux Linux Kernel 3.6 to 6.1.84, 6.2 to 6.6.24, 6.7 to 6.7.12, 6.8 to 6.8.3
Timeline
- 2024-03-08: patched: Initial patch authored by Alex Williamson
- 2024-04-05: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0e09cf81959d9f12b75ad5c6dd53d237432ed034
- https://git.kernel.org/stable/c/18c198c96a815c962adc2b9b77909eec0be7df4d
- https://git.kernel.org/stable/c/27d40bf72dd9a6600b76ad05859176ea9a1b4897
- https://git.kernel.org/stable/c/4c089cefe30924fbe20dd1ee92774ea1f5eca834
- https://git.kernel.org/stable/c/4cb0d7532126d23145329826c38054b4e9a05e7c
- https://git.kernel.org/stable/c/69276a555c740acfbff13fb5769ee9c92e1c828e
- https://git.kernel.org/stable/c/7d29d4c72c1e196cce6969c98072a272d1a703b3