CVE-2024-26990

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-26990
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26990.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-26990
Downstream
Related
Published
2024-05-01T05:27:48Z
Modified
2025-10-17T01:40:22.008757Z
Summary
KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status
Details

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status

Check kvmmmupageadneedwriteprotect() when deciding whether to write-protect or clear D-bits on TDP MMU SPTEs, so that the TDP MMU accounts for any role-specific reasons for disabling D-bit dirty logging.

Specifically, TDP MMU SPTEs must be write-protected when the TDP MMU is being used to run an L2 (i.e. L1 has disabled EPT) and PML is enabled. KVM always disables PML when running L2, even when L1 and L2 GPAs are in the some domain, so failing to write-protect TDP MMU SPTEs will cause writes made by L2 to not be reflected in the dirty log.

[sean: massage shortlog and changelog, tweak ternary op formatting]

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5982a5392663b30f57ee90b0372c19a7e9cb655a
Fixed
cdf811a937471af2d1facdf8ae80e5e68096f1ed
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5982a5392663b30f57ee90b0372c19a7e9cb655a
Fixed
e20bff0f1b2de9cfe303dd35ff46470104a87404
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5982a5392663b30f57ee90b0372c19a7e9cb655a
Fixed
2673dfb591a359c75080dd5af3da484b89320d22

Affected versions

v6.*

v6.3
v6.3-rc3
v6.3-rc4
v6.3-rc5
v6.3-rc6
v6.3-rc7
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.21
v6.6.22
v6.6.23
v6.6.24
v6.6.25
v6.6.26
v6.6.27
v6.6.28
v6.6.3
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.8.1
v6.8.2
v6.8.3
v6.8.4
v6.8.5
v6.8.6
v6.8.7
v6.9-rc1
v6.9-rc2
v6.9-rc3

Database specific

vanir_signatures

[
    {
        "id": "CVE-2024-26990-498cb018",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "55387072104228825521737997482659876500",
                "144707919624519973744047330289202053660",
                "134954231499274265978645624691135246637",
                "33812414090177196240032234062307176925",
                "243241513211532406037160625144292964356",
                "201207748364857277334796795574321164310",
                "328776639379537211068069939124167527752",
                "42202190384516066045283934941362275541",
                "233087428952926908080356688553495754161",
                "331441380338762776275638687981507059385",
                "10468123236445589258331115787686383256",
                "183513652304019780573696379267918106853",
                "318182755293282174658797861258588534937",
                "336436525881002475687731636457438345175",
                "12647045798598545291056467648953252994",
                "106425732344888144487596434658834421013",
                "296777941383141544628390444974061821145",
                "319550325130640348253835819952215474154",
                "20806875968841167156176968381681205719",
                "210945184509554704467715723933535360544"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "arch/x86/kvm/mmu/tdp_mmu.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e20bff0f1b2de9cfe303dd35ff46470104a87404"
    },
    {
        "id": "CVE-2024-26990-4e5bc9ea",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "55387072104228825521737997482659876500",
                "144707919624519973744047330289202053660",
                "134954231499274265978645624691135246637",
                "33812414090177196240032234062307176925",
                "243241513211532406037160625144292964356",
                "201207748364857277334796795574321164310",
                "328776639379537211068069939124167527752",
                "42202190384516066045283934941362275541",
                "233087428952926908080356688553495754161",
                "331441380338762776275638687981507059385",
                "10468123236445589258331115787686383256",
                "183513652304019780573696379267918106853",
                "318182755293282174658797861258588534937",
                "336436525881002475687731636457438345175",
                "12647045798598545291056467648953252994",
                "106425732344888144487596434658834421013",
                "296777941383141544628390444974061821145",
                "319550325130640348253835819952215474154",
                "20806875968841167156176968381681205719",
                "210945184509554704467715723933535360544"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "arch/x86/kvm/mmu/tdp_mmu.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2673dfb591a359c75080dd5af3da484b89320d22"
    },
    {
        "id": "CVE-2024-26990-6d4754a9",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "100669473334691478290167672122240295809",
            "length": 638.0
        },
        "target": {
            "file": "arch/x86/kvm/mmu/tdp_mmu.c",
            "function": "clear_dirty_gfn_range"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e20bff0f1b2de9cfe303dd35ff46470104a87404"
    },
    {
        "id": "CVE-2024-26990-7ad6b5b6",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "45591004277328536419655150588791550349",
            "length": 857.0
        },
        "target": {
            "file": "arch/x86/kvm/mmu/tdp_mmu.c",
            "function": "clear_dirty_pt_masked"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdf811a937471af2d1facdf8ae80e5e68096f1ed"
    },
    {
        "id": "CVE-2024-26990-a597da0f",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "45591004277328536419655150588791550349",
            "length": 857.0
        },
        "target": {
            "file": "arch/x86/kvm/mmu/tdp_mmu.c",
            "function": "clear_dirty_pt_masked"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e20bff0f1b2de9cfe303dd35ff46470104a87404"
    },
    {
        "id": "CVE-2024-26990-a908781b",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "100669473334691478290167672122240295809",
            "length": 638.0
        },
        "target": {
            "file": "arch/x86/kvm/mmu/tdp_mmu.c",
            "function": "clear_dirty_gfn_range"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2673dfb591a359c75080dd5af3da484b89320d22"
    },
    {
        "id": "CVE-2024-26990-bf3d9b3d",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "120544134429434857402663478217494213326",
            "length": 596.0
        },
        "target": {
            "file": "arch/x86/kvm/mmu/tdp_mmu.c",
            "function": "clear_dirty_gfn_range"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdf811a937471af2d1facdf8ae80e5e68096f1ed"
    },
    {
        "id": "CVE-2024-26990-cf4f67c5",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "55387072104228825521737997482659876500",
                "144707919624519973744047330289202053660",
                "134954231499274265978645624691135246637",
                "33812414090177196240032234062307176925",
                "243241513211532406037160625144292964356",
                "201207748364857277334796795574321164310",
                "328776639379537211068069939124167527752",
                "175333789228036966417981094580245276739",
                "16837145786495554925352395044631699602",
                "331441380338762776275638687981507059385",
                "10468123236445589258331115787686383256",
                "183513652304019780573696379267918106853",
                "318182755293282174658797861258588534937",
                "336436525881002475687731636457438345175",
                "12647045798598545291056467648953252994",
                "106425732344888144487596434658834421013",
                "296777941383141544628390444974061821145",
                "319550325130640348253835819952215474154",
                "20806875968841167156176968381681205719",
                "210945184509554704467715723933535360544"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "arch/x86/kvm/mmu/tdp_mmu.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdf811a937471af2d1facdf8ae80e5e68096f1ed"
    },
    {
        "id": "CVE-2024-26990-f1ac27f7",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "function_hash": "45591004277328536419655150588791550349",
            "length": 857.0
        },
        "target": {
            "file": "arch/x86/kvm/mmu/tdp_mmu.c",
            "function": "clear_dirty_pt_masked"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2673dfb591a359c75080dd5af3da484b89320d22"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.4.0
Fixed
6.6.29
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.8.8