CVE-2024-44948 x86/mtrr: Check if fixed MTRRs exist before saving them
A missing capability check in the Linux kernel x86 MTRR code causes a warning on CPUs without fixed MTRR support, potentially leading to system instability or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-44948?
CVE-2024-44948 is a medium-severity denial of service vulnerability in Linux kernel, published on 4 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
x86/mtrr: Check if fixed MTRRs exist before saving them
MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed variant has a separate capability bit in the MTRR capability MSR.
So far all x86 CPUs which support MTRR have this separate bit set, so it went unnoticed that mtrr_save_state() does not check the capability bit before accessing the fixed MTRR MSRs.
Though on a CPU that does not support the fixed MTRR capability this results in a #GP. The #GP itself is harmless because the RDMSR fault is handled gracefully, but results in a WARN_ON().
Add the missing capability check to prevent this.
Which versions are affected by CVE-2024-44948?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-44948?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-44948 being exploited?
There is no known exploitation of CVE-2024-44948 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-44948, DEBIAN-CVE-2024-44948, GHSA-7p6j-4w59-cjvv, UBUNTU-CVE-2024-44948.