CVE-2024-53195
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
27/12/2024
Last modified:
27/12/2024
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
KVM: arm64: Get rid of userspace_irqchip_in_use<br />
<br />
Improper use of userspace_irqchip_in_use led to syzbot hitting the<br />
following WARN_ON() in kvm_timer_update_irq():<br />
<br />
WARNING: CPU: 0 PID: 3281 at arch/arm64/kvm/arch_timer.c:459<br />
kvm_timer_update_irq+0x21c/0x394<br />
Call trace:<br />
kvm_timer_update_irq+0x21c/0x394 arch/arm64/kvm/arch_timer.c:459<br />
kvm_timer_vcpu_reset+0x158/0x684 arch/arm64/kvm/arch_timer.c:968<br />
kvm_reset_vcpu+0x3b4/0x560 arch/arm64/kvm/reset.c:264<br />
kvm_vcpu_set_target arch/arm64/kvm/arm.c:1553 [inline]<br />
kvm_arch_vcpu_ioctl_vcpu_init arch/arm64/kvm/arm.c:1573 [inline]<br />
kvm_arch_vcpu_ioctl+0x112c/0x1b3c arch/arm64/kvm/arm.c:1695<br />
kvm_vcpu_ioctl+0x4ec/0xf74 virt/kvm/kvm_main.c:4658<br />
vfs_ioctl fs/ioctl.c:51 [inline]<br />
__do_sys_ioctl fs/ioctl.c:907 [inline]<br />
__se_sys_ioctl fs/ioctl.c:893 [inline]<br />
__arm64_sys_ioctl+0x108/0x184 fs/ioctl.c:893<br />
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]<br />
invoke_syscall+0x78/0x1b8 arch/arm64/kernel/syscall.c:49<br />
el0_svc_common+0xe8/0x1b0 arch/arm64/kernel/syscall.c:132<br />
do_el0_svc+0x40/0x50 arch/arm64/kernel/syscall.c:151<br />
el0_svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712<br />
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730<br />
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598<br />
<br />
The following sequence led to the scenario:<br />
- Userspace creates a VM and a vCPU.<br />
- The vCPU is initialized with KVM_ARM_VCPU_PMU_V3 during<br />
KVM_ARM_VCPU_INIT.<br />
- Without any other setup, such as vGIC or vPMU, userspace issues<br />
KVM_RUN on the vCPU. Since the vPMU is requested, but not setup,<br />
kvm_arm_pmu_v3_enable() fails in kvm_arch_vcpu_run_pid_change().<br />
As a result, KVM_RUN returns after enabling the timer, but before<br />
incrementing &#39;userspace_irqchip_in_use&#39;:<br />
kvm_arch_vcpu_run_pid_change()<br />
ret = kvm_arm_pmu_v3_enable()<br />
if (!vcpu->arch.pmu.created)<br />
return -EINVAL;<br />
if (ret)<br />
return ret;<br />
[...]<br />
if (!irqchip_in_kernel(kvm))<br />
static_branch_inc(&userspace_irqchip_in_use);<br />
- Userspace ignores the error and issues KVM_ARM_VCPU_INIT again.<br />
Since the timer is already enabled, control moves through the<br />
following flow, ultimately hitting the WARN_ON():<br />
kvm_timer_vcpu_reset()<br />
if (timer->enabled)<br />
kvm_timer_update_irq()<br />
if (!userspace_irqchip())<br />
ret = kvm_vgic_inject_irq()<br />
ret = vgic_lazy_init()<br />
if (unlikely(!vgic_initialized(kvm)))<br />
if (kvm->arch.vgic.vgic_model !=<br />
KVM_DEV_TYPE_ARM_VGIC_V2)<br />
return -EBUSY;<br />
WARN_ON(ret);<br />
<br />
Theoretically, since userspace_irqchip_in_use&#39;s functionality can be<br />
simply replaced by &#39;!irqchip_in_kernel()&#39;, get rid of the static key<br />
to avoid the mismanagement, which also helps with the syzbot issue.