In the Linux kernel, the following vulnerability has been resolved:
drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()
Patch series "mm: follow_pte() improvements and acrn follow_pte() fixes".
Patch #1 fixes a bunch of issues I spotted in the acrn driver. It compiles, that's all I know. I'll appreciate some review and testing from acrn folks.
Patch #2+#3 improve follow_pte(), passing a VMA instead of the MM, adding more sanity checks, and improving the documentation. Gave it a quick test on x86-64 using VM_PAT that ends up using follow_pte().
This patch (of 3):
We currently miss handling various cases, resulting in a dangerous follow_pte() (previously follow_pfn()) usage.
(1) We're not checking PTE write permissions.
Maybe we should simply always require pte_write() like we do for pin_user_pages_fast(FOLL_WRITE)? Hard to tell, so let's check for ACRN_MEM_ACCESS_WRITE for now.
(2) We're not rejecting refcounted pages.
As we are not using MMU notifiers, messing with refcounted pages is dangerous and can result in use-after-free. Let's make sure to reject them.
(3) We are only looking at the first PTE of a bigger range.
We only lookup a single PTE, but memmap->len may span a larger area. Let's loop over all involved PTEs and make sure the PFN range is actually contiguous. Reject everything else: it couldn't have worked either way, and rather made use access PFNs we shouldn't be accessing.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 19, 2024 |
| Suse | — | Upgrade kernel-sourceUpgrade dlm-kmp-64kbUpgrade kernel-default-develUpgrade kselftests-kmp-azureUpgrade kernel-debug-develUpgrade dtb-allwinnerUpgrade kernel-64kb-extraUpgrade dtb-sprdUpgrade dtb-freescaleUpgrade kernel-debug-vdsoUpgrade kernel-default-optionalUpgrade kernel-source-azureUpgrade kernel-rt-develUpgrade dtb-qcomUpgrade cluster-md-kmp-64kbUpgrade dtb-rockchipUpgrade kernel-64kb-optionalUpgrade kernel-default-livepatchUpgrade dtb-exynosUpgrade kernel-debugUpgrade kernel-obs-buildUpgrade reiserfs-kmp-defaultUpgrade kernel-default-base-rebuildUpgrade kernel-rt_debug-livepatch-develUpgrade gfs2-kmp-defaultUpgrade kernel-64kbUpgrade kernel-azure-optionalUpgrade kernel-devel-rtUpgrade kernel-default-baseUpgrade kernel-default-vdsoUpgrade dtb-xilinxUpgrade ocfs2-kmp-64kbUpgrade dtb-amazonUpgrade dtb-renesasUpgrade dtb-hisiliconUpgrade kselftests-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-source-vanillaUpgrade dtb-mediatekUpgrade kernel-rt-extraUpgrade kernel-default-livepatch-develUpgrade dlm-kmp-rtUpgrade dtb-lgUpgrade cluster-md-kmp-rtUpgrade kernel-develUpgrade kernel-64kb-develUpgrade kernel-rt_debug-develUpgrade gfs2-kmp-azureUpgrade kernel-azureUpgrade dtb-alteraUpgrade dtb-caviumUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-kvmsmallUpgrade dtb-broadcomUpgrade dtb-socionextUpgrade dtb-marvellUpgrade kernel-azure-extraUpgrade kernel-rt_debugUpgrade kernel-zfcpdumpUpgrade dlm-kmp-azureUpgrade kernel-kvmsmall-develUpgrade kernel-macrosUpgrade dtb-apmUpgrade reiserfs-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-source-rtUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-docsUpgrade gfs2-kmp-rtUpgrade dtb-nvidiaUpgrade dtb-amdUpgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-default-extraUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kernel-syms-azureUpgrade dtb-armUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade kernel-rt-vdsoUpgrade kernel-defaultUpgrade kernel-azure-develUpgrade kernel-rt-livepatch-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-symsUpgrade kernel-kvmsmall-vdsoUpgrade kernel-docs-htmlUpgrade kernel-devel-azureUpgrade kernel-rtUpgrade kernel-azure-livepatch-develUpgrade gfs2-kmp-64kbUpgrade kernel-obs-qaUpgrade kernel-rt_debug-vdsoUpgrade dtb-appleUpgrade dtb-amlogicUpgrade kselftests-kmp-rt | Jul 23, 2024 | Jun 19, 2024 |
| Ubuntu | — | Upgrade linux-image-genericUpgrade linux-image-5.15.0-1052-gkeopUpgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-121-generic-64kUpgrade linux-image-5.15.0-121-lowlatency-64kUpgrade linux-image-gke-5.15Upgrade linux-image-gkeopUpgrade linux-image-6.8.0-1013-awsUpgrade linux-image-6.8.0-1010-oemUpgrade linux-image-5.15.0-1062-raspiUpgrade linux-image-oem-20.04Upgrade linux-image-intelUpgrade linux-image-6.8.0-1010-ibmUpgrade linux-image-oem-24.04aUpgrade linux-image-5.15.0-1072-azureUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-nvidiaUpgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-40-lowlatencyUpgrade linux-image-generic-lpaeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-intel-iotgUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-gkeUpgrade linux-image-6.8.0-1011-nvidia-lowlatency-64kUpgrade linux-image-oem-20.04cUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-5.15.0-1066-kvmUpgrade linux-image-oem-20.04dUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-1062-ibmUpgrade linux-image-5.15.0-121-generic-lpaeUpgrade linux-image-generic-64kUpgrade linux-image-oracle-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-40-lowlatency-64kUpgrade linux-image-virtualUpgrade linux-image-5.15.0-1072-azure-fdeUpgrade linux-image-raspiUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-ibmUpgrade linux-image-oem-24.04Upgrade linux-image-5.15.0-121-lowlatencyUpgrade linux-image-6.8.0-1009-raspiUpgrade linux-image-azureUpgrade linux-image-gcpUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.15.0-1066-gkeUpgrade linux-image-6.8.0-1011-nvidiaUpgrade linux-image-6.8.0-1008-gkeUpgrade linux-image-5.15.0-121-genericUpgrade linux-image-oracleUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-1069-awsUpgrade linux-image-ibm-classicUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-6.8.0-1012-azureUpgrade linux-image-6.8.0-1010-oracle-64kUpgrade linux-image-aws-lts-22.04Upgrade linux-image-6.8.0-1012-azure-fdeUpgrade linux-image-5.15.0-1064-nvidiaUpgrade linux-image-6.8.0-1010-oracleUpgrade linux-image-6.8.0-1011-nvidia-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1011-nvidia-lowlatencyUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-40-genericUpgrade linux-image-5.15.0-1067-oracleUpgrade linux-image-awsUpgrade linux-image-kvmUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-azure-cvmUpgrade linux-image-azure-fdeUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1064-intel-iotgUpgrade linux-image-5.15.0-1064-nvidia-lowlatencyUpgrade linux-image-nvidia-6.8Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.15.0-1068-gcpUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-6.8.0-1012-gcpUpgrade linux-image-6.8.0-40-generic-64kUpgrade linux-image-nvidia-64k-6.8 | Aug 9, 2024 | Jun 19, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Jun 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub