In the Linux kernel, the following vulnerability has been resolved:
PCI/MSI: Fix UAF in msi_capability_init
KFENCE reports the following UAF:
BUG: KFENCE: use-after-free read in __pci_enable_msi_range+0x2c0/0x488
Use-after-free read at 0x0000000024629571 (in kfence-#12): __pci_enable_msi_range+0x2c0/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28
kfence-#12: 0x0000000008614900-0x00000000e06c228d, size=104, cache=kmalloc-128
allocated by task 81 on cpu 7 at 10.808142s: __kmem_cache_alloc_node+0x1f0/0x2bc kmalloc_trace+0x44/0x138 msi_alloc_desc+0x3c/0x9c msi_domain_insert_msi_desc+0x30/0x78 msi_setup_msi_desc+0x13c/0x184 __pci_enable_msi_range+0x258/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28
freed by task 81 on cpu 7 at 10.811436s: msi_domain_free_descs+0xd4/0x10c msi_domain_free_locked.part.0+0xc0/0x1d8 msi_domain_alloc_irqs_all_locked+0xb4/0xbc pci_msi_setup_msi_irqs+0x30/0x4c __pci_enable_msi_range+0x2a8/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28
Descriptor allocation done in: __pci_enable_msi_range msi_capability_init msi_setup_msi_desc msi_insert_msi_desc msi_domain_insert_msi_desc msi_alloc_desc ...
Freed in case of failure in __msi_domain_alloc_locked() __pci_enable_msi_range msi_capability_init pci_msi_setup_msi_irqs msi_domain_alloc_irqs_all_locked msi_domain_alloc_locked __msi_domain_alloc_locked => fails msi_domain_free_locked ...
That failure propagates back to pci_msi_setup_msi_irqs() in msi_capability_init() which accesses the descriptor for unmasking in the error exit path.
Cure it by copying the descriptor and using the copy for the error exit path unmask operation.
[ tglx: Massaged change log ]
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-rtUpgrade kernel-toolsUpgrade kernel-devel-matchedUpgrade kernel-debug-modules-extraUpgrade kernel-64k-debug-coreUpgrade libperfUpgrade kernel-docUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-debugUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-debug-devel-matchedUpgrade rvUpgrade kernel-64k-debug-modules-extraUpgrade kernel-cross-headersUpgrade kernel-headersUpgrade kernel-64k-coreUpgrade kernel-abi-stablelistsUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade bpftoolUpgrade kernel-debug-develUpgrade kernel-rt-debugUpgrade kernel-modulesUpgrade python3-perfUpgrade kernel-debug-uki-virtUpgrade kernel-coreUpgrade kernel-debug-coreUpgrade kernel-64kUpgrade kernel-debugUpgrade kernel-modules-extraUpgrade kernel-develUpgrade kernel-64k-develUpgrade kernelUpgrade kernel-tools-libsUpgrade perfUpgrade rtlaUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-coreUpgrade kernel-64k-modulesUpgrade kernel-64k-modules-extraUpgrade kernel-64k-debug-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-64k-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-develUpgrade kernel-uki-virtUpgrade kernel-debug-modules-coreUpgrade kernel-64k-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-devel | Nov 4, 2024 | Jul 29, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-6.1.109-118.189Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpfUpgrade perf-debuginfoUpgrade python3-perfUpgrade kernel-tools-develUpgrade kernel-modules-extraUpgrade perfUpgrade kernel-develUpgrade kernel-libbpf-staticUpgrade kernel-toolsUpgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extra-commonUpgrade kernelUpgrade bpftool | Feb 17, 2025 | Jul 29, 2024 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Oct 7, 2024 | Jul 29, 2024 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | Jul 29, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Dec 5, 2024 | Jul 29, 2024 |
| Rocky_linux | — | Upgrade kernel-debug-debuginfoUpgrade kernel-zfcpdump-coreUpgrade libperf-debuginfoUpgrade kernel-headersUpgrade kernel-rtUpgrade kernelUpgrade kernel-toolsUpgrade kernel-rt-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-zfcpdumpUpgrade libperfUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debuginfoUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-modules-coreUpgrade kernel-cross-headersUpgrade kernel-rt-debug-coreUpgrade kernel-tools-libs-develUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-develUpgrade kernel-rt-modulesUpgrade kernel-debug-modulesUpgrade bpftool-debuginfoUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-rt-modules-extraUpgrade rvUpgrade kernel-rt-debug-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-develUpgrade python3-perfUpgrade kernel-rt-debugUpgrade kernel-tools-debuginfoUpgrade kernel-debug-develUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-uki-virtUpgrade kernel-tools-libsUpgrade kernel-develUpgrade perfUpgrade kernel-zfcpdump-debuginfoUpgrade rtlaUpgrade python3-perf-debuginfoUpgrade kernel-modules-extraUpgrade kernel-coreUpgrade bpftoolUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-coreUpgrade kernel-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-modules-coreUpgrade kernel-modulesUpgrade kernel-debugUpgrade kernel-debug-coreUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-modulesUpgrade perf-debuginfo | Sep 17, 2024 | Jul 29, 2024 |
| Suse | — | Upgrade kernel-obs-qaUpgrade kernel-rt-optionalUpgrade dtb-freescaleUpgrade gfs2-kmp-azureUpgrade kernel-default-develUpgrade kernel-default-optionalUpgrade kernel-develUpgrade kernel-rt_debug-develUpgrade kernel-zfcpdumpUpgrade kernel-azure-develUpgrade kernel-azure-extraUpgrade dtb-amazonUpgrade kernel-devel-azureUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-rtUpgrade dtb-qcomUpgrade dtb-apmUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-alteraUpgrade dtb-lgUpgrade kernel-azure-optionalUpgrade kernel-default-vdsoUpgrade kernel-kvmsmallUpgrade kernel-64kb-livepatch-develUpgrade kernel-source-rtUpgrade kernel-docs-htmlUpgrade ocfs2-kmp-64kbUpgrade kernel-rtUpgrade dtb-xilinxUpgrade cluster-md-kmp-azureUpgrade gfs2-kmp-rtUpgrade kernel-64kb-develUpgrade kernel-64kb-optionalUpgrade dtb-broadcomUpgrade kernel-default-base-rebuildUpgrade kernel-source-azureUpgrade kernel-sourceUpgrade kernel-syms-azureUpgrade kernel-symsUpgrade kernel-default-extraUpgrade dtb-caviumUpgrade dtb-exynosUpgrade gfs2-kmp-64kbUpgrade kselftests-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade kernel-default-livepatchUpgrade kernel-macrosUpgrade ocfs2-kmp-rtUpgrade dtb-amlogicUpgrade kernel-rt-develUpgrade kselftests-kmp-64kbUpgrade kernel-64kbUpgrade kernel-debug-develUpgrade dtb-renesasUpgrade kernel-obs-buildUpgrade dtb-mediatekUpgrade dtb-allwinnerUpgrade reiserfs-kmp-azureUpgrade kernel-rt-vdsoUpgrade kernel-debug-vdsoUpgrade kernel-64kb-extraUpgrade cluster-md-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-sprdUpgrade kernel-docsUpgrade kernel-debugUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade dtb-appleUpgrade kernel-azure-vdsoUpgrade dtb-amdUpgrade kernel-syms-rtUpgrade kernel-debug-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-rt_debugUpgrade dtb-nvidiaUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-rtUpgrade kernel-source-vanillaUpgrade kernel-kvmsmall-vdsoUpgrade dlm-kmp-rtUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade dtb-marvellUpgrade dtb-hisiliconUpgrade kernel-devel-rtUpgrade kernel-default-baseUpgrade kernel-azureUpgrade gfs2-kmp-defaultUpgrade dtb-socionextUpgrade dtb-armUpgrade kernel-rt-extraUpgrade kernel-defaultUpgrade dtb-rockchipUpgrade dlm-kmp-azureUpgrade kselftests-kmp-rt | Dec 5, 2025 | Sep 12, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-48-genericUpgrade linux-image-kvmUpgrade linux-image-gcpUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1017-azureUpgrade linux-image-6.8.0-1018-awsUpgrade linux-image-oracle-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-azureUpgrade linux-image-6.8.0-1016-azureUpgrade linux-image-6.8.0-1016-azure-fdeUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1015-oracle-64kUpgrade linux-image-6.8.0-1014-raspiUpgrade linux-image-awsUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-oem-22.04dUpgrade linux-image-oem-24.04aUpgrade linux-image-nvidia-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1017-azure-fdeUpgrade linux-image-6.8.0-1017-nvidia-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1017-nvidia-lowlatencyUpgrade linux-image-6.8.0-1017-gcpUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-48-lowlatency-64kUpgrade linux-image-6.8.0-1014-ibmUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1016-oemUpgrade linux-image-ibm-classicUpgrade linux-image-oem-22.04bUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-generic-64kUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-genericUpgrade linux-image-gkeop-6.8Upgrade linux-image-raspiUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-48-lowlatencyUpgrade linux-image-gkeopUpgrade linux-image-oem-24.04Upgrade linux-image-lowlatencyUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1015-oracleUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oracleUpgrade linux-image-generic-lpaeUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1016-gcpUpgrade linux-image-ibmUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1017-nvidiaUpgrade linux-image-6.8.0-48-generic-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1013-gkeUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1017-nvidia-lowlatency-64k | Nov 4, 2024 | Jul 29, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub