In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: arm64: nv: Fix null ptr deref on nested wp\/unmap, teardown race<\/p>\n
Commit 7270cc9157f4 (“KVM: arm64: nv: Handle VNCR_EL2 invalidation from MMU
\nnotifiers”) introduced VNCR_EL2 invalidation in both kvm_nested_s2_unmap()
\nand kvm_nested_s2_wp().<\/p>\n
However at the point of this being performed concurrent stage 2 teardown of
\na nested guest can cause kvm->arch.mmu.pgt to be set to NULL.<\/p>\n
This happens in kvm_flush_shadow_all() -> kvm_arch_flush_shadow_all() ->
\nkvm_free_stage2_pgd() and is performed under the kvm->mmu_lock.<\/p>\n
Commit ec14c272408a (“KVM: arm64: nv: Unmap\/flush shadow stage 2 page
\ntables”) introduced the teardown of the entire nested MMU range, which then
\ninvokes stage2_apply_range() with resched=true:<\/p>\n
mmu_notifier_invalidate_range_start()
\n -> … -> kvm_mmu_notifier_invalidate_range_start()
\n -> kvm_mmu_unmap_gfn_range()
\n -> kvm_unmap_gfn_range()
\n -> kvm_nested_s2_unmap()
\n -> kvm_stage2_unmap_range()
\n -> __unmap_stage2_range()
\n -> stage2_apply_range()<\/p>\n
This means that stage2_apply_range() can drop the kvm->mmu_lock and thus
\nconcurrent progress can be made in lockstep with
\nkvm_arch_flush_shadow_all().<\/p>\n
If kvm_arch_flush_shadow_all() advances ahead of stage2_apply_range() and
\ncompletes its operation it guarantees a NULL pointer deref.<\/p>\n
Since kvm_free_stage2_pgd() is performed under the kvm->mmu_lock this will
\neither be observed NULL or not and serialised against
\nkvm_free_stage2_pgd().<\/p>\n
Resolve the issue by abstracting the invalidation to a new function,
\nkvm_invalidate_vncr_ipa_all(), and check that the pgt is non-NULL before
\ndereferencing it.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: arm64: nv: Fix null ptr deref on nested wp\/unmap, teardown race<\/p>\n
Commit 7270cc9157f4 (“KVM: arm64: nv: Handle VNCR_EL2 invalid<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40939","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}