In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect()
KASAN reports the following issue:
BUG: KASAN: stack-out-of-bounds in kvm_make_vcpus_request_mask+0x174/0x440 [kvm] Read of size 8 at addr ffffc9001364f638 by task qemu-kvm/4798
CPU: 0 PID: 4798 Comm: qemu-kvm Tainted: G X --------- --- Hardware name: AMD Corporation DAYTONA_X/DAYTONA_X, BIOS RYM0081C 07/13/2020 Call Trace: dump_stack+0xa5/0xe6 print_address_description.constprop.0+0x18/0x130 ? kvm_make_vcpus_request_mask+0x174/0x440 [kvm] __kasan_report.cold+0x7f/0x114 ? kvm_make_vcpus_request_mask+0x174/0x440 [kvm] kasan_report+0x38/0x50 kasan_check_range+0xf5/0x1d0 kvm_make_vcpus_request_mask+0x174/0x440 [kvm] kvm_make_scan_ioapic_request_mask+0x84/0xc0 [kvm] ? kvm_arch_exit+0x110/0x110 [kvm] ? sched_clock+0x5/0x10 ioapic_write_indirect+0x59f/0x9e0 [kvm] ? static_obj+0xc0/0xc0 ? __lock_acquired+0x1d2/0x8c0 ? kvm_ioapic_eoi_inject_work+0x120/0x120 [kvm]
The problem appears to be that 'vcpu_bitmap' is allocated as a single long on stack and it should really be KVM_MAX_VCPUS long. We also seem to clear the lower 16 bits of it with bitmap_zero() for no particular reason (my guess would be that 'bitmap' and 'vcpu_bitmap' variables in kvm_bitmap_or_dest_vcpus() caused the confusion: while the later is indeed 16-bit long, the later should accommodate all possible vCPUs).
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.10.75-79.358Upgrade kernel-tools-develUpgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfoUpgrade perfUpgrade bpftool-debuginfoUpgrade python-perfUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools | Dec 12, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-zfcpdumpUpgrade kernel-syms-azureUpgrade kernel-docs-htmlUpgrade kernel-debugUpgrade gfs2-kmp-rtUpgrade kernel-azureUpgrade kernel-debug-vdsoUpgrade dtb-alteraUpgrade dtb-exynosUpgrade kernel-rt-optionalUpgrade kernel-64kbUpgrade dtb-socionextUpgrade ocfs2-kmp-defaultUpgrade kernel-source-rtUpgrade kernel-kvmsmall-develUpgrade kernel-default-develUpgrade kernel-symsUpgrade dtb-amdUpgrade kernel-rt-livepatch-develUpgrade dtb-allwinnerUpgrade dtb-appleUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade kernel-source-azureUpgrade dtb-renesasUpgrade reiserfs-kmp-rtUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade dtb-caviumUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-amazonUpgrade kernel-sourceUpgrade kernel-rt_debug-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt_debugUpgrade kernel-azure-optionalUpgrade reiserfs-kmp-defaultUpgrade dtb-hisiliconUpgrade kernel-azure-vdsoUpgrade dtb-freescaleUpgrade kernel-64kb-optionalUpgrade kernel-azure-livepatch-develUpgrade kselftests-kmp-azureUpgrade kernel-default-livepatchUpgrade kernel-default-vdsoUpgrade gfs2-kmp-defaultUpgrade gfs2-kmp-azureUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade kernel-source-vanillaUpgrade kselftests-kmp-64kbUpgrade dtb-lgUpgrade dlm-kmp-64kbUpgrade kernel-debug-develUpgrade dtb-broadcomUpgrade gfs2-kmp-64kbUpgrade kernel-azure-extraUpgrade kernel-rt-vdsoUpgrade dtb-marvellUpgrade ocfs2-kmp-64kbUpgrade dtb-amlogicUpgrade kernel-rt-develUpgrade dtb-nvidiaUpgrade kernel-develUpgrade kselftests-kmp-defaultUpgrade dtb-mediatekUpgrade kernel-debug-livepatch-develUpgrade dtb-armUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-livepatchUpgrade kernel-default-base-rebuildUpgrade kernel-default-baseUpgrade kernel-rtUpgrade kernel-devel-rtUpgrade ocfs2-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-macrosUpgrade dtb-xilinxUpgrade kernel-defaultUpgrade kernel-obs-qaUpgrade cluster-md-kmp-defaultUpgrade kernel-64kb-extraUpgrade dtb-apmUpgrade kernel-docsUpgrade dlm-kmp-azureUpgrade kernel-default-livepatch-develUpgrade cluster-md-kmp-rtUpgrade kernel-obs-buildUpgrade dlm-kmp-rtUpgrade kernel-default-optionalUpgrade kselftests-kmp-rtUpgrade kernel-rt-extraUpgrade reiserfs-kmp-azureUpgrade dtb-sprdUpgrade kernel-default-extraUpgrade kernel-64kb-develUpgrade dtb-qcomUpgrade dtb-rockchipUpgrade dlm-kmp-defaultUpgrade kernel-azure-develUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-syms-rt | Aug 9, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub