CVE-2024-46864

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-46864
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-46864.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-46864
Downstream
Related
Published
2024-09-27T12:42:52Z
Modified
2025-10-09T18:00:56.735012Z
Summary
x86/hyperv: fix kexec crash due to VP assist page corruption
Details

In the Linux kernel, the following vulnerability has been resolved:

x86/hyperv: fix kexec crash due to VP assist page corruption

commit 9636be85cc5b ("x86/hyperv: Fix hypervpcpuinput_arg handling when CPUs go online/offline") introduces a new cpuhp state for hyperv initialization.

cpuhpsetupstate() returns the state number if state is CPUHPAPONLINEDYN or CPUHPBPPREPAREDYN and 0 for all other states. For the hyperv case, since a new cpuhp state was introduced it would return 0. However, in hvmachineshutdown(), the cpuhpremovestate() call is conditioned upon "hypervinitcpuhp > 0". This will never be true and so hvcpudie() won't be called on all CPUs. This means the VP assist page won't be reset. When the kexec kernel tries to setup the VP assist page again, the hypervisor corrupts the memory region of the old VP assist page causing a panic in case the kexec kernel is using that memory elsewhere. This was originally fixed in commit dfe94d4086e4 ("x86/hyperv: Fix kexec panic/hang issues").

Get rid of hypervinitcpuhp entirely since we are no longer using a dynamic cpuhp state and use CPUHPAPHYPERVONLINE directly with cpuhpremove_state().

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
9636be85cc5bdd8b7a7f6a53405cbcc52161c93c
Fixed
2ae1beb3ab4f28868cc5d1541d05e1fbee3ad825
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
9636be85cc5bdd8b7a7f6a53405cbcc52161c93c
Fixed
d6f018a3b49d0a94ddbd0e479c2af6b19724e434
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
9636be85cc5bdd8b7a7f6a53405cbcc52161c93c
Fixed
b9af6418279c4cf73ca073f8ea024992b38be8ab

Affected versions

v6.*

v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.10.1
v6.10.10
v6.10.2
v6.10.3
v6.10.4
v6.10.5
v6.10.6
v6.10.7
v6.10.8
v6.10.9
v6.4
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.21
v6.6.22
v6.6.23
v6.6.24
v6.6.25
v6.6.26
v6.6.27
v6.6.28
v6.6.29
v6.6.3
v6.6.30
v6.6.31
v6.6.32
v6.6.33
v6.6.34
v6.6.35
v6.6.36
v6.6.37
v6.6.38
v6.6.39
v6.6.4
v6.6.40
v6.6.41
v6.6.42
v6.6.43
v6.6.44
v6.6.45
v6.6.46
v6.6.47
v6.6.48
v6.6.49
v6.6.5
v6.6.50
v6.6.51
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.4.0
Fixed
6.6.52
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.10.11