In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect()
KASAN reports the following issue:
BUG: KASAN: stack-out-of-bounds in kvm_make_vcpus_request_mask+0x174/0x440 [kvm] Read of size 8 at addr ffffc9001364f638 by task qemu-kvm/4798
CPU: 0 PID: 4798 Comm: qemu-kvm Tainted: G X --------- --- Hardware name: AMD Corporation DAYTONA_X/DAYTONA_X, BIOS RYM0081C 07/13/2020 Call Trace: dump_stack+0xa5/0xe6 print_address_description.constprop.0+0x18/0x130 ? kvm_make_vcpus_request_mask+0x174/0x440 [kvm] __kasan_report.cold+0x7f/0x114 ? kvm_make_vcpus_request_mask+0x174/0x440 [kvm] kasan_report+0x38/0x50 kasan_check_range+0xf5/0x1d0 kvm_make_vcpus_request_mask+0x174/0x440 [kvm] kvm_make_scan_ioapic_request_mask+0x84/0xc0 [kvm] ? kvm_arch_exit+0x110/0x110 [kvm] ? sched_clock+0x5/0x10 ioapic_write_indirect+0x59f/0x9e0 [kvm] ? static_obj+0xc0/0xc0 ? __lock_acquired+0x1d2/0x8c0 ? kvm_ioapic_eoi_inject_work+0x120/0x120 [kvm]
The problem appears to be that 'vcpu_bitmap' is allocated as a single long on stack and it should really be KVM_MAX_VCPUS long. We also seem to clear the lower 16 bits of it with bitmap_zero() for no particular reason (my guess would be that 'bitmap' and 'vcpu_bitmap' variables in kvm_bitmap_or_dest_vcpus() caused the confusion: while the later is indeed 16-bit long, the later should accommodate all possible vCPUs).
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade python-perfUpgrade bpftoolUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-livepatch-5.10.75-79.358Upgrade kernelUpgrade kernel-tools-devel | Dec 12, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade cluster-md-kmp-defaultUpgrade kernel-rt_debug-vdsoUpgrade reiserfs-kmp-azureUpgrade dtb-qcomUpgrade kernel-64kb-extraUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-apmUpgrade kernel-docsUpgrade dlm-kmp-azureUpgrade kernel-default-livepatch-develUpgrade kernel-default-extraUpgrade dlm-kmp-rtUpgrade dlm-kmp-defaultUpgrade dtb-nvidiaUpgrade kernel-macrosUpgrade kernel-defaultUpgrade dtb-xilinxUpgrade dtb-rockchipUpgrade dtb-mediatekUpgrade kernel-azure-develUpgrade kernel-obs-buildUpgrade kernel-default-optionalUpgrade kernel-obs-qaUpgrade dtb-sprdUpgrade kernel-rt-develUpgrade kernel-rtUpgrade kernel-64kb-develUpgrade dtb-amlogicUpgrade kselftests-kmp-rtUpgrade kernel-rt-extraUpgrade ocfs2-kmp-azureUpgrade kernel-default-baseUpgrade dtb-armUpgrade cluster-md-kmp-64kbUpgrade kernel-syms-rtUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-devel-rtUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-livepatchUpgrade kernel-default-base-rebuildUpgrade kernel-develUpgrade kselftests-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-rt-optionalUpgrade kernel-rt-livepatch-develUpgrade dtb-amdUpgrade ocfs2-kmp-64kbUpgrade kernel-source-vanillaUpgrade reiserfs-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-azure-livepatch-develUpgrade kernel-default-vdsoUpgrade dtb-exynosUpgrade kernel-kvmsmall-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade kernel-azure-extraUpgrade kernel-64kb-optionalUpgrade dlm-kmp-64kbUpgrade kernel-azure-vdsoUpgrade dtb-appleUpgrade kernel-default-develUpgrade kernel-kvmsmallUpgrade dtb-lgUpgrade dtb-broadcomUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-defaultUpgrade kernel-debugUpgrade dtb-freescaleUpgrade kernel-syms-azureUpgrade cluster-md-kmp-azureUpgrade dtb-amazonUpgrade kernel-rt_debug-develUpgrade dtb-alteraUpgrade dtb-hisiliconUpgrade kernel-kvmsmall-vdsoUpgrade dtb-marvellUpgrade gfs2-kmp-64kbUpgrade dtb-caviumUpgrade kernel-sourceUpgrade kselftests-kmp-azureUpgrade kernel-rt_debugUpgrade kernel-default-livepatchUpgrade kernel-zfcpdumpUpgrade kernel-azure-optionalUpgrade kernel-64kbUpgrade dtb-socionextUpgrade kernel-azureUpgrade kernel-source-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-symsUpgrade kernel-debug-vdsoUpgrade kernel-kvmsmall-develUpgrade dtb-renesasUpgrade dtb-allwinnerUpgrade kernel-docs-htmlUpgrade kernel-devel-azureUpgrade gfs2-kmp-rtUpgrade reiserfs-kmp-rt | Aug 9, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub