In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
LoongArch: KVM: Validate MSI data before routing it to EIOINTC<\/p>\n
pch_msi_set_irq() passes e->msi.data straight into eiointc_set_irq() as
\nthe irq number. The MSI data comes from userspace, that either via a
\nKVM_IRQ_ROUTING_MSI entry set with KVM_SET_GSI_ROUTING (used by irqfd
\nand KVM_IRQ_LINE) or directly via KVM_SIGNAL_MSI, and is never checked
\nagainst EIOINTC_IRQS.<\/p>\n
eiointc_set_irq() uses the value with __set_bit()\/__clear_bit() on the
\n256-bit isr bitmap, eiointc_update_irq() then indexes sw_coremap[] and
\nthe per-cpu coreisr\/sw_coreisr bitmaps with it. Therefore a data value
\n>= 256 reads and writes memory past the end of those arrays, i.e. any
\nprocess holding a VM fd can corrupt kernel memory beyond the allocation
\nof loongarch_eiointc.<\/p>\n
Reject MSI data that doesn’t fit in the EIOINTC irq space. The DMSINTC
\npath is unaffected as it decodes the vector from the address and masks
\nit.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
LoongArch: KVM: Validate MSI data before routing it to EIOINTC<\/p>\n
pch_msi_set_irq() passes e->msi.data straight into eiointc_set_irq(<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24594","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24594","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24594"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24594"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24594"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}