In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect()
KASAN reports the following issue:
BUG: KASAN: stack-out-of-bounds in kvm_make_vcpus_request_mask+0x174/0x440 [kvm] Read of size 8 at addr ffffc9001364f638 by task qemu-kvm/4798
CPU: 0 PID: 4798 Comm: qemu-kvm Tainted: G X --------- --- Hardware name: AMD Corporation DAYTONA_X/DAYTONA_X, BIOS RYM0081C 07/13/2020 Call Trace: dump_stack+0xa5/0xe6 print_address_description.constprop.0+0x18/0x130 ? kvm_make_vcpus_request_mask+0x174/0x440 [kvm] __kasan_report.cold+0x7f/0x114 ? kvm_make_vcpus_request_mask+0x174/0x440 [kvm] kasan_report+0x38/0x50 kasan_check_range+0xf5/0x1d0 kvm_make_vcpus_request_mask+0x174/0x440 [kvm] kvm_make_scan_ioapic_request_mask+0x84/0xc0 [kvm] ? kvm_arch_exit+0x110/0x110 [kvm] ? sched_clock+0x5/0x10 ioapic_write_indirect+0x59f/0x9e0 [kvm] ? static_obj+0xc0/0xc0 ? __lock_acquired+0x1d2/0x8c0 ? kvm_ioapic_eoi_inject_work+0x120/0x120 [kvm]
The problem appears to be that 'vcpu_bitmap' is allocated as a single long on stack and it should really be KVM_MAX_VCPUS long. We also seem to clear the lower 16 bits of it with bitmap_zero() for no particular reason (my guess would be that 'bitmap' and 'vcpu_bitmap' variables in kvm_bitmap_or_dest_vcpus() caused the confusion: while the later is indeed 16-bit long, the later should accommodate all possible vCPUs).
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.10.75-79.358Upgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-develUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernelUpgrade python-perfUpgrade bpftool-debuginfoUpgrade perfUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools | Dec 12, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-default-baseUpgrade dtb-sprdUpgrade kselftests-kmp-defaultUpgrade dtb-amlogicUpgrade dtb-mediatekUpgrade ocfs2-kmp-azureUpgrade kernel-develUpgrade kernel-devel-rtUpgrade cluster-md-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-64kb-develUpgrade dtb-nvidiaUpgrade dtb-qcomUpgrade dtb-rockchipUpgrade kernel-default-extraUpgrade kernel-default-optionalUpgrade kselftests-kmp-rtUpgrade kernel-obs-buildUpgrade kernel-azure-develUpgrade dtb-apmUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-livepatch-develUpgrade kernel-docsUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-azureUpgrade kernel-syms-rtUpgrade kernel-macrosUpgrade kernel-rt-develUpgrade kernel-rt_debug-vdsoUpgrade dtb-armUpgrade kernel-default-base-rebuildUpgrade cluster-md-kmp-64kbUpgrade kernel-rtUpgrade kernel-64kb-extraUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-extraUpgrade dtb-xilinxUpgrade dlm-kmp-defaultUpgrade dlm-kmp-rtUpgrade kernel-defaultUpgrade kernel-obs-qaUpgrade kernel-rt-livepatchUpgrade dtb-caviumUpgrade ocfs2-kmp-64kbUpgrade kernel-debug-develUpgrade gfs2-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade kernel-64kbUpgrade kernel-syms-azureUpgrade kernel-zfcpdumpUpgrade dtb-socionextUpgrade gfs2-kmp-rtUpgrade kernel-rt_debugUpgrade kernel-azure-optionalUpgrade kernel-64kb-optionalUpgrade dtb-broadcomUpgrade dtb-lgUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt-vdsoUpgrade kernel-debugUpgrade kernel-azure-vdsoUpgrade kernel-azure-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade kernel-source-vanillaUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-defaultUpgrade dtb-alteraUpgrade kernel-default-vdsoUpgrade gfs2-kmp-azureUpgrade kernel-rt_debug-develUpgrade dtb-exynosUpgrade kernel-azureUpgrade kernel-kvmsmallUpgrade kernel-docs-htmlUpgrade kselftests-kmp-64kbUpgrade kernel-azure-extraUpgrade kernel-rt-optionalUpgrade dtb-appleUpgrade kernel-default-develUpgrade kernel-default-livepatchUpgrade cluster-md-kmp-azureUpgrade dtb-renesasUpgrade reiserfs-kmp-rtUpgrade kernel-devel-azureUpgrade kernel-source-azureUpgrade dtb-amdUpgrade kernel-kvmsmall-develUpgrade kernel-symsUpgrade dtb-allwinnerUpgrade kernel-debug-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-source-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-sourceUpgrade kselftests-kmp-azureUpgrade dtb-freescaleUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-marvellUpgrade dtb-amazonUpgrade dtb-hisilicon | Aug 9, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub