Executive brief
A vulnerability in the Linux kernel's VFIO PCI driver could allow a local user to cause a permanent interruption of service for certain hardware devices. The issue affects how the system handles hardware interrupts for older devices or those with specific technical limitations. If exploited, the device could become unresponsive, potentially disrupting operations that rely on that specific hardware component.
Technical details
A race condition exists in the vfio/pci driver during the setup of exclusive INTx interrupts for devices without DisINTx support. In affected versions, the IRQ is enabled via request_irq() before being conditionally disabled to match the masked status flag. If an interrupt fires during this window, the disable depth can be incremented twice, creating a state that is unrecoverable for the user because the masked flag prevents nested enables. The fix involves using the IRQF_NO_AUTOEN flag to ensure the interrupt is not automatically enabled upon request, allowing the driver to safely unmask it only when required under proper locking.
Affected products
- Linux Linux Kernel 3.6 to 6.1.84, 6.2 to 6.6.24, 6.7 to 6.7.12, 6.8 to 6.8.3
Timeline
- 2024-04-05: advisory: Initial publication of CVE-2024-27437
- 2024-03-29: patched: Fix committed to Linux stable tree
References
- https://git.kernel.org/stable/c/139dfcc4d723ab13469881200c7d80f49d776060
- https://git.kernel.org/stable/c/26389925d6c2126fb777821a0a983adca7ee6351
- https://git.kernel.org/stable/c/2a4a666c45107206605b7b5bc20545f8aabc4fa2
- https://git.kernel.org/stable/c/3b3491ad0f80d913e7d255941d4470f4a4d9bfda
- https://git.kernel.org/stable/c/561d5e1998d58b54ce2bbbb3e843b669aa0b3db5
- https://git.kernel.org/stable/c/b7a2f0955ffceffadfe098b40b50307431f45438
- https://git.kernel.org/stable/c/bf0bc84a20e6109ab07d5dc072067bd01eb931ec