In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()<\/p>\n
kvmhv_emulate_tlbie_all_lpid() iterates the nested-guest IDR and drops
\nmmu_lock before calling kvmhv_emulate_tlbie_lpid(), but does not hold a
\nreference on the kvm_nested_guest pointer obtained from the IDR. A
\nconcurrent vCPU issuing a single-LPID tlbie (is=2, ric=2) can race
\nthrough kvmhv_flush_nested() -> kvmhv_remove_nested() -> idr_remove \/
\n–refcnt -> kvmhv_release_nested() -> kfree(gp) in that window, leaving
\nthe iterating vCPU with a dangling pointer. The subsequent
\nmutex_lock(&gp->tlb_lock) and accesses to gp->shadow_pgtable,
\ngp->shadow_lpid and gp->l1_host all touch freed memory. The free path
\nis fully L1-controlled.<\/p>\n
Fix this by incrementing gp->refcnt inside the loop before dropping
\nmmu_lock, mirroring what kvmhv_get_nested() does, and releasing the
\nreference with kvmhv_put_nested() after the per-guest work completes.
\nThis is the same get\/put discipline already used at every other
\ncall site that drops mmu_lock while holding a nested-guest pointer.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()<\/p>\n
kvmhv_emulate_tlbie_all_lpid() iterates the nested-guest<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33352","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33352","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33352"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33352"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33352"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}