CVE-2024-26812 vfio/pci: Create persistent INTx handler
A null pointer dereference in the Linux kernel VFIO PCI driver allows local attackers to cause a denial of service via specific interrupt handling sequences.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26812?
CVE-2024-26812 is a high-severity vulnerability in Debian Debian Linux, published on 5 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vfio/pci: Create persistent INTx handler
A vulnerability exists where the eventfd for INTx signaling can be deconfigured, which unregisters the IRQ handler but still allows eventfds to be signaled with a NULL context through the SET_IRQS ioctl or through unmask irqfd if the device interrupt is pending.
Ideally this could be solved with some additional locking; the igate mutex serializes the ioctl and config space accesses, and the interrupt handler is unregistered relative to the trigger, but the irqfd path runs asynchronous to those. The igate mutex cannot be acquired from the atomic context of the eventfd wake function. Disabling the irqfd relative to the eventfd registration is potentially incompatible with existing userspace.
As a result, the solution implemented here moves configuration of the INTx interrupt handler to track the lifetime of the INTx context object and irq_type configuration, rather than registration of a particular trigger eventfd. Synchronization is added between the ioctl path and eventfd_signal() wrapper such that the eventfd trigger can be dynamically updated relative to in-flight interrupts or irqfd callbacks.
Weakness: CWE-476
Which versions are affected by CVE-2024-26812?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2024-26812?
Apply the vendor's patch.
Is CVE-2024-26812 being exploited?
There is no known exploitation of CVE-2024-26812 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-58836, BELL-CVE-2024-26812, DEBIAN-CVE-2024-26812, GHSA-p8g6-7v7w-4whg, UBUNTU-CVE-2024-26812.