In the Linux kernel, the following vulnerability has been resolved:
PCI/MSI: Fix UAF in msi_capability_init
KFENCE reports the following UAF:
BUG: KFENCE: use-after-free read in __pci_enable_msi_range+0x2c0/0x488
Use-after-free read at 0x0000000024629571 (in kfence-#12): __pci_enable_msi_range+0x2c0/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28
kfence-#12: 0x0000000008614900-0x00000000e06c228d, size=104, cache=kmalloc-128
allocated by task 81 on cpu 7 at 10.808142s: __kmem_cache_alloc_node+0x1f0/0x2bc kmalloc_trace+0x44/0x138 msi_alloc_desc+0x3c/0x9c msi_domain_insert_msi_desc+0x30/0x78 msi_setup_msi_desc+0x13c/0x184 __pci_enable_msi_range+0x258/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28
freed by task 81 on cpu 7 at 10.811436s: msi_domain_free_descs+0xd4/0x10c msi_domain_free_locked.part.0+0xc0/0x1d8 msi_domain_alloc_irqs_all_locked+0xb4/0xbc pci_msi_setup_msi_irqs+0x30/0x4c __pci_enable_msi_range+0x2a8/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28
Descriptor allocation done in: __pci_enable_msi_range msi_capability_init msi_setup_msi_desc msi_insert_msi_desc msi_domain_insert_msi_desc msi_alloc_desc ...
Freed in case of failure in __msi_domain_alloc_locked() __pci_enable_msi_range msi_capability_init pci_msi_setup_msi_irqs msi_domain_alloc_irqs_all_locked msi_domain_alloc_locked __msi_domain_alloc_locked => fails msi_domain_free_locked ...
That failure propagates back to pci_msi_setup_msi_irqs() in msi_capability_init() which accesses the descriptor for unmasking in the error exit path.
Cure it by copying the descriptor and using the copy for the error exit path unmask operation.
[ tglx: Massaged change log ]
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-develUpgrade kernel-modulesUpgrade kernelUpgrade kernel-64k-debug-modules-coreUpgrade kernel-modules-extraUpgrade kernel-64kUpgrade kernel-64k-debug-develUpgrade kernel-zfcpdump-develUpgrade python3-perfUpgrade kernel-rt-debugUpgrade kernel-64k-debug-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-debugUpgrade kernel-64k-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-64k-modulesUpgrade bpftoolUpgrade kernel-coreUpgrade kernel-debug-coreUpgrade kernel-develUpgrade rtlaUpgrade kernel-debug-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-rt-develUpgrade kernel-tools-libsUpgrade perfUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-uki-virtUpgrade kernel-64k-debug-modules-extraUpgrade kernel-toolsUpgrade kernel-zfcpdump-modulesUpgrade kernel-tools-libs-develUpgrade libperfUpgrade kernel-modules-coreUpgrade rvUpgrade kernel-64k-coreUpgrade kernel-cross-headersUpgrade kernel-rt-debug-modules-coreUpgrade kernel-docUpgrade kernel-rtUpgrade kernel-zfcpdump-coreUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-modulesUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-64k-debug-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-abi-stablelistsUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-debugUpgrade kernel-rt-modules-extraUpgrade kernel-headers | Nov 4, 2024 | Jul 29, 2024 |
| Amazon_linux_2023 | — | Upgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernel-libbpf-staticUpgrade kernel-modules-extra-commonUpgrade kernel-libbpf-develUpgrade bpftoolUpgrade kernelUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-6.1.109-118.189Upgrade kernel-debuginfoUpgrade kernel-modules-extraUpgrade kernel-tools-develUpgrade kernel-libbpfUpgrade python3-perfUpgrade perfUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade perf-debuginfo | Feb 17, 2025 | Jul 29, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Oct 7, 2024 | Jul 29, 2024 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | Jul 29, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Dec 5, 2024 | Jul 29, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-coreUpgrade bpftoolUpgrade kernel-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade python3-perfUpgrade kernel-rt-debugUpgrade kernel-rt-debug-debuginfoUpgrade rtlaUpgrade kernel-rt-kvmUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-coreUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-tools-libsUpgrade kernel-uki-virtUpgrade kernel-modules-extraUpgrade kernel-debug-develUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debuginfoUpgrade kernel-develUpgrade python3-perf-debuginfoUpgrade kernel-debugUpgrade kernel-modulesUpgrade kernel-rt-develUpgrade perf-debuginfoUpgrade kernel-rt-modules-coreUpgrade bpftool-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-kvmUpgrade kernelUpgrade rvUpgrade kernel-rt-modules-extraUpgrade kernel-toolsUpgrade libperfUpgrade kernel-rtUpgrade kernel-rt-modulesUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-headersUpgrade kernel-cross-headersUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-coreUpgrade kernel-debug-debuginfoUpgrade libperf-debuginfoUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdump-devel | Sep 17, 2024 | Jul 29, 2024 |
| Suse | — | Upgrade dtb-hisiliconUpgrade kernel-debug-develUpgrade dlm-kmp-rtUpgrade dtb-marvellUpgrade dtb-renesasUpgrade kernel-kvmsmall-vdsoUpgrade kernel-source-vanillaUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-defaultUpgrade kernel-obs-buildUpgrade kselftests-kmp-rtUpgrade dlm-kmp-azureUpgrade kernel-defaultUpgrade dtb-rockchipUpgrade cluster-md-kmp-defaultUpgrade kernel-debugUpgrade kernel-debug-livepatch-develUpgrade dtb-amdUpgrade kernel-rt_debugUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-64kbUpgrade kernel-syms-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-vdsoUpgrade reiserfs-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-64kb-extraUpgrade kernel-rt-extraUpgrade kernel-azure-vdsoUpgrade ocfs2-kmp-azureUpgrade kernel-docsUpgrade reiserfs-kmp-defaultUpgrade kernel-devel-rtUpgrade dtb-armUpgrade dtb-socionextUpgrade dtb-appleUpgrade kernel-default-livepatch-develUpgrade kernel-default-baseUpgrade dtb-nvidiaUpgrade gfs2-kmp-defaultUpgrade kernel-rt_debug-vdsoUpgrade reiserfs-kmp-rtUpgrade kernel-azureUpgrade dtb-mediatekUpgrade dtb-sprdUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-qcomUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-alteraUpgrade kernel-default-livepatchUpgrade dtb-amazonUpgrade kernel-kvmsmall-develUpgrade kernel-azure-develUpgrade cluster-md-kmp-rtUpgrade kernel-azure-extraUpgrade kernel-64kb-develUpgrade ocfs2-kmp-defaultUpgrade kernel-64kbUpgrade kernel-default-vdsoUpgrade kernel-source-rtUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-rtUpgrade dtb-xilinxUpgrade kernel-default-optionalUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kernel-symsUpgrade kernel-sourceUpgrade kernel-develUpgrade kernel-macrosUpgrade kernel-default-develUpgrade dtb-freescaleUpgrade kernel-rt-optionalUpgrade kernel-obs-qaUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-rtUpgrade kernel-rtUpgrade ocfs2-kmp-64kbUpgrade dtb-broadcomUpgrade kernel-azure-optionalUpgrade kernel-syms-azureUpgrade kernel-64kb-optionalUpgrade kselftests-kmp-64kbUpgrade dtb-lgUpgrade gfs2-kmp-azureUpgrade kernel-docs-htmlUpgrade kernel-default-base-rebuildUpgrade kernel-rt-develUpgrade dtb-caviumUpgrade kernel-source-azureUpgrade dtb-amlogicUpgrade gfs2-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade dlm-kmp-64kbUpgrade dtb-exynosUpgrade kernel-kvmsmallUpgrade kernel-default-extraUpgrade kernel-zfcpdumpUpgrade kernel-rt_debug-develUpgrade kernel-devel-azureUpgrade dtb-apm | Dec 5, 2025 | Sep 12, 2024 |
| Ubuntu | — | Upgrade linux-image-lowlatencyUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1013-gkeUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1015-oracleUpgrade linux-image-6.8.0-1016-gcpUpgrade linux-image-6.8.0-48-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-gkeUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-gkeopUpgrade linux-image-nvidiaUpgrade linux-image-raspiUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-22.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-6.8.0-1017-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-genericUpgrade linux-image-oem-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1017-nvidiaUpgrade linux-image-6.8.0-48-generic-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-generic-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-azureUpgrade linux-image-6.8.0-1017-gcpUpgrade linux-image-6.8.0-1014-ibmUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1002-gkeopUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1017-azureUpgrade linux-image-6.8.0-1018-awsUpgrade linux-image-6.8.0-1016-azure-fdeUpgrade linux-image-6.8.0-1017-nvidia-64kUpgrade linux-image-6.8.0-48-genericUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-gcpUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.8.0-1015-oracle-64kUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1016-oemUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1017-azure-fdeUpgrade linux-image-6.8.0-48-lowlatency-64kUpgrade linux-image-virtualUpgrade linux-image-ibm-classicUpgrade linux-image-oem-22.04bUpgrade linux-image-oracle-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-awsUpgrade linux-image-6.8.0-1016-azureUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1014-raspiUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1017-nvidia-lowlatency | Nov 4, 2024 | Jul 29, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub