CVE-2024-40953

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()<br /> <br /> Use {READ,WRITE}_ONCE() to access kvm-&gt;last_boosted_vcpu to ensure the<br /> loads and stores are atomic. In the extremely unlikely scenario the<br /> compiler tears the stores, it&amp;#39;s theoretically possible for KVM to attempt<br /> to get a vCPU using an out-of-bounds index, e.g. if the write is split<br /> into multiple 8-bit stores, and is paired with a 32-bit load on a VM with<br /> 257 vCPUs:<br /> <br /> CPU0 CPU1<br /> last_boosted_vcpu = 0xff;<br /> <br /> (last_boosted_vcpu = 0x100)<br /> last_boosted_vcpu[15:8] = 0x01;<br /> i = (last_boosted_vcpu = 0x1ff)<br /> last_boosted_vcpu[7:0] = 0x00;<br /> <br /> vcpu = kvm-&gt;vcpu_array[0x1ff];<br /> <br /> As detected by KCSAN:<br /> <br /> BUG: KCSAN: data-race in kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm]<br /> <br /> write to 0xffffc90025a92344 of 4 bytes by task 4340 on cpu 16:<br /> kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4112) kvm<br /> handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel<br /> vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?<br /> arch/x86/kvm/vmx/vmx.c:6606) kvm_intel<br /> vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm<br /> kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm<br /> kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm<br /> __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)<br /> __x64_sys_ioctl (fs/ioctl.c:890)<br /> x64_sys_call (arch/x86/entry/syscall_64.c:33)<br /> do_syscall_64 (arch/x86/entry/common.c:?)<br /> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)<br /> <br /> read to 0xffffc90025a92344 of 4 bytes by task 4342 on cpu 4:<br /> kvm_vcpu_on_spin (arch/x86/kvm/../../../virt/kvm/kvm_main.c:4069) kvm<br /> handle_pause (arch/x86/kvm/vmx/vmx.c:5929) kvm_intel<br /> vmx_handle_exit (arch/x86/kvm/vmx/vmx.c:?<br /> arch/x86/kvm/vmx/vmx.c:6606) kvm_intel<br /> vcpu_run (arch/x86/kvm/x86.c:11107 arch/x86/kvm/x86.c:11211) kvm<br /> kvm_arch_vcpu_ioctl_run (arch/x86/kvm/x86.c:?) kvm<br /> kvm_vcpu_ioctl (arch/x86/kvm/../../../virt/kvm/kvm_main.c:?) kvm<br /> __se_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:904 fs/ioctl.c:890)<br /> __x64_sys_ioctl (fs/ioctl.c:890)<br /> x64_sys_call (arch/x86/entry/syscall_64.c:33)<br /> do_syscall_64 (arch/x86/entry/common.c:?)<br /> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)<br /> <br /> value changed: 0x00000012 -&gt; 0x00000000