CVE-2024-35791 KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
A use-after-free vulnerability in the Linux kernel's KVM SVM module allows local attackers to potentially execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-35791?
CVE-2024-35791 is a high-severity use after free vulnerability in Debian Debian Linux, published on 17 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()
Do the cache flush of converted pages in svm_register_enc_region() before dropping kvm->lock to fix use-after-free issues where region and/or its array of pages could be freed by a different task, e.g. if userspace has __unregister_enc_region_locked() already queued up for the region.
Note, the "obvious" alternative of using local variables doesn't fully resolve the bug, as region->pages is also dynamically allocated. I.e. the region structure itself would be fine, but region->pages could be freed.
Flushing multiple pages under kvm->lock is unfortunate, but the entire flow is a rare slow path, and the manual flush is only needed on CPUs that lack coherency for encrypted memory.
Weakness: CWE-416
Which versions are affected by CVE-2024-35791?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2024-35791?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-35791 being exploited?
There is no known exploitation of CVE-2024-35791 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BELL-CVE-2024-35791, DEBIAN-CVE-2024-35791, GHSA-wm4c-jgh8-m62g, UBUNTU-CVE-2024-35791.