In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: arm64: vgic-its: Don’t dereference a NULL collection on ITT save<\/p>\n
MAPC with V=0 drops ite->collection but leaves the ITE on the device’s
\nITT list, and vgic_its_save_ite() dereferences it unconditionally. A
\nguest that issues MAPD, MAPTI and then MAPC(V=0) therefore oopses the
\nhost when the VMM issues KVM_DEV_ARM_ITS_SAVE_TABLES to migrate it.
\nThat sequence is UNPREDICTABLE per the architecture, but KVM already
\nhandles the resulting state in the translate, MOVI and DISCARD paths.<\/p>\n
Save a zeroed entry, which vgic_its_restore_ite() reads back as
\ninvalid. Skipping the ITE instead would leave the ITT slot holding
\nwhatever is in guest memory, and restore rejects an entry naming a
\ncollection the restored collection table does not have.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: arm64: vgic-its: Don’t dereference a NULL collection on ITT save<\/p>\n
MAPC with V=0 drops ite->collection but leaves the ITE on th<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24599","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24599","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24599"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24599"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24599"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}