In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: SEV: Nullify “have run CPUs” mask pointer when freeing it<\/p>\n
Nullify have_run_cpus when freeing the mask, particularly in the error path
\nof __sev_guest_init(), so that KVM doesn’t have to subtly use sev->active
\nto track whether or not the mask has been freed. As pointed out by Sashiko,
\nblindly freeing the mask in sev_vm_destroy() results in a double-free if
\nthe mask is freed if __sev_guest_init() fails.<\/p>\n
Throw the logic in a helper as nullifying the pointer is frustratingly
\ndifficult and weird due to have_run_cpus being a single-entry array when
\nCPUMASK_OFFSTACK=n. Deliberately don’t use CPUMASK_VAR_NULL, as it’s not
\ndirectly assignable when the cpumask is on-stack, e.g. requires using a
\nlocal variable and a memcpy(), which is beyond ridiculous. Furthermore,
\nwhile clearing the on-stack bitmask is an unnecessary and arguably unwanted
\nside effect, KVM absolutely relies on ‘0’ being the “null” value given that
\nthe struct is zero-allocated.<\/p>\n
Opportunistically add an alloc() helper to pair with free(); there are just
\nenough call sites to make doing so worthwhile.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: SEV: Nullify “have run CPUs” mask pointer when freeing it<\/p>\n
Nullify have_run_cpus when freeing the mask, particularly in the er<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41191","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41191","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41191"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41191"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41191"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}