In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Flush pages under kvm->lock to fix UAF in svmregisterenc_region()
Do the cache flush of converted pages in svmregisterencregion() before dropping kvm->lock to fix use-after-free issues where region and/or its array of pages could be freed by a different task, e.g. if userspace has _unregisterencregion_locked() already queued up for the region.
Note, the "obvious" alternative of using local variables doesn't fully resolve the bug, as region->pages is also dynamically allocated. I.e. the region structure itself would be fine, but region->pages could be freed.
Flushing multiple pages under kvm->lock is unfortunate, but the entire flow is a rare slow path, and the manual flush is only needed on CPUs that lack coherency for encrypted memory.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35791.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-35791.json"
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807",
"digest": {
"length": 871.0,
"function_hash": "34117091534823587441612840727440429909"
},
"id": "CVE-2024-35791-01f405f2",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c",
"function": "sev_mem_enc_register_region"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865",
"digest": {
"length": 871.0,
"function_hash": "34117091534823587441612840727440429909"
},
"id": "CVE-2024-35791-0a1cb09d",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c",
"function": "sev_mem_enc_register_region"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807",
"digest": {
"line_hashes": [
"263816931461026815601687541744909426528",
"287453695515527866221251770169964882177",
"326642812391388800233164387176178552373",
"140388130507549386982317500729232806425",
"189904685349981167031623357478185583513",
"83256363944502943393981878028577796736",
"139455535948842516663740329932502085507",
"35751556705548854350645935838291686685"
],
"threshold": 0.9
},
"id": "CVE-2024-35791-1c3a0f64",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865",
"digest": {
"line_hashes": [
"263816931461026815601687541744909426528",
"287453695515527866221251770169964882177",
"326642812391388800233164387176178552373",
"140388130507549386982317500729232806425",
"189904685349981167031623357478185583513",
"83256363944502943393981878028577796736",
"139455535948842516663740329932502085507",
"35751556705548854350645935838291686685"
],
"threshold": 0.9
},
"id": "CVE-2024-35791-249b8ccf",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12f8e32a5a389a5d58afc67728c76e61beee1ad4",
"digest": {
"line_hashes": [
"263816931461026815601687541744909426528",
"287453695515527866221251770169964882177",
"326642812391388800233164387176178552373",
"140388130507549386982317500729232806425",
"189904685349981167031623357478185583513",
"83256363944502943393981878028577796736",
"139455535948842516663740329932502085507",
"35751556705548854350645935838291686685"
],
"threshold": 0.9
},
"id": "CVE-2024-35791-2f2bb43f",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e126b508ed2e616d679d85fca2fbe77bb48bbdd7",
"digest": {
"line_hashes": [
"263816931461026815601687541744909426528",
"287453695515527866221251770169964882177",
"326642812391388800233164387176178552373",
"140388130507549386982317500729232806425",
"189904685349981167031623357478185583513",
"83256363944502943393981878028577796736",
"139455535948842516663740329932502085507",
"35751556705548854350645935838291686685"
],
"threshold": 0.9
},
"id": "CVE-2024-35791-9a5bc20a",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d13b79640b147bd77c34a5998533b2021a4122d",
"digest": {
"length": 827.0,
"function_hash": "315895499894791046845284250368100839496"
},
"id": "CVE-2024-35791-a3f1e94f",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c",
"function": "svm_register_enc_region"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6d53d8a2617dd58c89171a6b9610c470ebda38a",
"digest": {
"length": 871.0,
"function_hash": "34117091534823587441612840727440429909"
},
"id": "CVE-2024-35791-ad049606",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c",
"function": "sev_mem_enc_register_region"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6d53d8a2617dd58c89171a6b9610c470ebda38a",
"digest": {
"line_hashes": [
"263816931461026815601687541744909426528",
"287453695515527866221251770169964882177",
"326642812391388800233164387176178552373",
"140388130507549386982317500729232806425",
"189904685349981167031623357478185583513",
"83256363944502943393981878028577796736",
"139455535948842516663740329932502085507",
"35751556705548854350645935838291686685"
],
"threshold": 0.9
},
"id": "CVE-2024-35791-cc0329f5",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e126b508ed2e616d679d85fca2fbe77bb48bbdd7",
"digest": {
"length": 871.0,
"function_hash": "34117091534823587441612840727440429909"
},
"id": "CVE-2024-35791-e05e407b",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c",
"function": "svm_register_enc_region"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d13b79640b147bd77c34a5998533b2021a4122d",
"digest": {
"line_hashes": [
"263816931461026815601687541744909426528",
"287453695515527866221251770169964882177",
"326642812391388800233164387176178552373",
"140388130507549386982317500729232806425",
"189904685349981167031623357478185583513",
"83256363944502943393981878028577796736",
"139455535948842516663740329932502085507",
"35751556705548854350645935838291686685"
],
"threshold": 0.9
},
"id": "CVE-2024-35791-e61b51a2",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12f8e32a5a389a5d58afc67728c76e61beee1ad4",
"digest": {
"length": 871.0,
"function_hash": "34117091534823587441612840727440429909"
},
"id": "CVE-2024-35791-f5415077",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "arch/x86/kvm/svm/sev.c",
"function": "sev_mem_enc_register_region"
}
}
]