CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-36911 – hv_netvsc: Don't free decrypted memory
https://notcve.org/view.php?id=CVE-2024-36911
In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. The netvsc driver could free decrypted/shared pages if set_memory_decrypted() fails. Check the decrypted field in the gpadl to decide whether to free the memory. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: hv_netvsc: no liberar memoria descifrada. En las máquinas virtuales CoCo, es posible que el host que no es de confianza provoque que set_memory_encrypted() o set_memory_decrypted() falle, de modo que se devuelva un error y el resultado La memoria es compartida. • https://git.kernel.org/stable/c/a56fe611326332bf6b7126e5559590c57dcebad4 https://git.kernel.org/stable/c/4aaed9dbe8acd2b6114458f0498a617283d6275b https://git.kernel.org/stable/c/bbf9ac34677b57506a13682b31a2a718934c0e31 •
CVSS: 6.2EPSS: 0%CPEs: 4EXPL: 0CVE-2024-36910 – uio_hv_generic: Don't free decrypted memory
https://notcve.org/view.php?id=CVE-2024-36910
In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. The VMBus device UIO driver could free decrypted/shared pages if set_memory_decrypted() fails. Check the decrypted field in the gpadl to decide whether to free the memory. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: uio_hv_generic: no liberar memoria descifrada. En las máquinas virtuales CoCo, es posible que el host que no es de confianza provoque que set_memory_encrypted() o set_memory_decrypted() falle, de modo que se devuelva un error y el resultado La memoria es compartida. • https://git.kernel.org/stable/c/dabf12bf994318d939f70d47cfda30e47abb2c54 https://git.kernel.org/stable/c/6466a0f6d235c8a18c602cb587160d7e49876db9 https://git.kernel.org/stable/c/fe2c58602354fbd60680dc42ac3a0b772cda7d23 https://git.kernel.org/stable/c/3d788b2fbe6a1a1a9e3db09742b90809d51638b7 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2024-36909 – Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
https://notcve.org/view.php?id=CVE-2024-36909
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. The VMBus ring buffer code could free decrypted/shared pages if set_memory_decrypted() fails. Check the decrypted field in the struct vmbus_gpadl for the ring buffers to decide whether to free the memory. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Controladores: hv: vmbus: no liberar búferes de anillo que no se pudieron volver a cifrar. En las máquinas virtuales CoCo, es posible que el host que no es de confianza cause set_memory_encrypted() o set_memory_decrypted( ) falle de modo que se devuelva un error y se comparta la memoria resultante. • https://git.kernel.org/stable/c/2f622008bf784a9f5dd17baa19223cc2ac30a039 https://git.kernel.org/stable/c/82f9e213b124a7d2bb5b16ea35d570260ef467e0 https://git.kernel.org/stable/c/a9212a4e2963a7fbe3864ba33dc551d4ad8d0abb https://git.kernel.org/stable/c/30d18df6567be09c1433e81993e35e3da573ac48 •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-36908 – blk-iocost: do not WARN if iocg was already offlined
https://notcve.org/view.php?id=CVE-2024-36908
In the Linux kernel, the following vulnerability has been resolved: blk-iocost: do not WARN if iocg was already offlined In iocg_pay_debt(), warn is triggered if 'active_list' is empty, which is intended to confirm iocg is active when it has debt. However, warn can be triggered during a blkcg or disk removal, if iocg_waitq_timer_fn() is run at that time: WARNING: CPU: 0 PID: 2344971 at block/blk-iocost.c:1402 iocg_pay_debt+0x14c/0x190 Call trace: iocg_pay_debt+0x14c/0x190 iocg_kick_waitq+0x438/0x4c0 iocg_waitq_timer_fn+0xd8/0x130 __run_hrtimer+0x144/0x45c __hrtimer_run_queues+0x16c/0x244 hrtimer_interrupt+0x2cc/0x7b0 The warn in this situation is meaningless. Since this iocg is being removed, the state of the 'active_list' is irrelevant, and 'waitq_timer' is canceled after removing 'active_list' in ioc_pd_free(), which ensures iocg is freed after iocg_waitq_timer_fn() returns. Therefore, add the check if iocg was already offlined to avoid warn when removing a blkcg or disk. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: blk-iocost: no ADVERTIR si iocg ya estaba desconectado. En iocg_pay_debt(), se activa una advertencia si 'active_list' está vacía, lo que pretende confirmar que iocg está activo cuando deuda. • https://git.kernel.org/stable/c/1c172ac7afe4442964f4153b2c78fe4e005d9d67 https://git.kernel.org/stable/c/14b3275f93d4a0d8ddc02195bc4e9869b7a3700e https://git.kernel.org/stable/c/01bc4fda9ea0a6b52f12326486f07a4910666cf6 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2024-36906 – ARM: 9381/1: kasan: clear stale stack poison
https://notcve.org/view.php?id=CVE-2024-36906
In the Linux kernel, the following vulnerability has been resolved: ARM: 9381/1: kasan: clear stale stack poison We found below OOB crash: [ 33.452494] ================================================================== [ 33.453513] BUG: KASAN: stack-out-of-bounds in refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec [ 33.454660] Write of size 164 at addr c1d03d30 by task swapper/0/0 [ 33.455515] [ 33.455767] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O 6.1.25-mainline #1 [ 33.456880] Hardware name: Generic DT based system [ 33.457555] unwind_backtrace from show_stack+0x18/0x1c [ 33.458326] show_stack from dump_stack_lvl+0x40/0x4c [ 33.459072] dump_stack_lvl from print_report+0x158/0x4a4 [ 33.459863] print_report from kasan_report+0x9c/0x148 [ 33.460616] kasan_report from kasan_check_range+0x94/0x1a0 [ 33.461424] kasan_check_range from memset+0x20/0x3c [ 33.462157] memset from refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec [ 33.463064] refresh_cpu_vm_stats.constprop.0 from tick_nohz_idle_stop_tick+0x180/0x53c [ 33.464181] tick_nohz_idle_stop_tick from do_idle+0x264/0x354 [ 33.465029] do_idle from cpu_startup_entry+0x20/0x24 [ 33.465769] cpu_startup_entry from rest_init+0xf0/0xf4 [ 33.466528] rest_init from arch_post_acpi_subsys_init+0x0/0x18 [ 33.467397] [ 33.467644] The buggy address belongs to stack of task swapper/0/0 [ 33.468493] and is located at offset 112 in frame: [ 33.469172] refresh_cpu_vm_stats.constprop.0+0x0/0x2ec [ 33.469917] [ 33.470165] This frame has 2 objects: [ 33.470696] [32, 76) 'global_zone_diff' [ 33.470729] [112, 276) 'global_node_diff' [ 33.471294] [ 33.472095] The buggy address belongs to the physical page: [ 33.472862] page:3cd72da8 refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x41d03 [ 33.473944] flags: 0x1000(reserved|zone=0) [ 33.474565] raw: 00001000 ed741470 ed741470 00000000 00000000 00000000 ffffffff 00000001 [ 33.475656] raw: 00000000 [ 33.476050] page dumped because: kasan: bad access detected [ 33.476816] [ 33.477061] Memory state around the buggy address: [ 33.477732] c1d03c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.478630] c1d03c80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 [ 33.479526] >c1d03d00: 00 04 f2 f2 f2 f2 00 00 00 00 00 00 f1 f1 f1 f1 [ 33.480415] ^ [ 33.481195] c1d03d80: 00 00 00 00 00 00 00 00 00 00 04 f3 f3 f3 f3 f3 [ 33.482088] c1d03e00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.482978] ================================================================== We find the root cause of this OOB is that arm does not clear stale stack poison in the case of cpuidle. This patch refer to arch/arm64/kernel/sleep.S to resolve this issue. From cited commit [1] that explain the problem Functions which the compiler has instrumented for KASAN place poison on the stack shadow upon entry and remove this poison prior to returning. In the case of cpuidle, CPUs exit the kernel a number of levels deep in C code. Any instrumented functions on this critical path will leave portions of the stack shadow poisoned. If CPUs lose context and return to the kernel via a cold path, we restore a prior context saved in __cpu_suspend_enter are forgotten, and we never remove the poison they placed in the stack shadow area by functions calls between this and the actual exit of the kernel. Thus, (depending on stackframe layout) subsequent calls to instrumented functions may hit this stale poison, resulting in (spurious) KASAN splats to the console. To avoid this, clear any stale poison from the idle thread for a CPU prior to bringing a CPU online. From cited commit [2] Extend to check for CONFIG_KASAN_STACK [1] commit 0d97e6d8024c ("arm64: kasan: clear stale stack poison") [2] commit d56a9ef84bd0 ("kasan, arm64: unpoison stack only with CONFIG_KASAN_STACK") En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ARM: 9381/1: kasan: borrar veneno de pila obsoleta Encontramos el siguiente fallo de OOB: [33.452494] ================== =================================================== [ 33.453513] ERROR: KASAN: pila fuera de los límites en refresco_cpu_vm_stats.constprop.0+0xcc/0x2ec [33.454660] Escritura de tamaño 164 en la dirección c1d03d30 mediante task swapper/0/0 [33.455515] [33.455767] CPU: 0 PID : 0 Comm: swapper/0 Tainted: GO 6.1.25-mainline #1 [ 33.456880] Nombre del hardware: Sistema basado en DT genérico [ 33.457555] unwind_backtrace from show_stack+0x18/0x1c [ 33.458326] show_stack from dump_stack_lvl+0x40/0x4c [ 33.45 9072] dump_stack_lvl de print_report+0x158/0x4a4 [ 33.459863] print_report de kasan_report+0x9c/0x148 [ 33.460616] kasan_report de kasan_check_range+0x94/0x1a0 [ 33.461424] kasan_check_range de memset+0x20/0x 3c [33.462157] conjunto de memorias de refresco_cpu_vm_stats.constprop.0+0xcc/ 0x2ec [33.463064] refresco_cpu_vm_stats.constprop.0 de tick_nohz_idle_stop_tick+0x180/0x53c [33.464181] tick_nohz_idle_stop_tick de do_idle+0x264/0x354 [33.465029] do_idle de cpu_startup _entry+0x20/0x24 [ 33.465769] cpu_startup_entry de rest_init+0xf0/0xf4 [ 33.466528] rest_init de arch_post_acpi_subsys_init+0x0/0x18 [33.467397] [33.467644] La dirección con errores pertenece a la pila de task swapper/0/0 [33.468493] y se encuentra en el desplazamiento 112 en el framework: [33.469172] [ 33.469917 ] [ 33.470165] Este framework tiene 2 objetos: [ 33.470696] [32, 76) 'global_zone_diff' [ 33.470729] [112, 276) 'global_node_diff' [ 33.471294] [ 33.472095] La dirección con errores pertenece a la página física: [ 33.47 2862] página:3cd72da8 refcount:1 mapcount:0 mapeo:00000000 índice:0x0 pfn:0x41d03 [ 33.473944] banderas: 0x1000(reservado|zona=0) [ 33.474565] raw: 00001000 ed741470 ed741470 00000000 000000 00000000 ffffffff 00000001 [ 33.475656] sin formato: 00000000 [33.476050] página volcada porque: kasan: mal acceso detectado [33.476816] [33.477061] Estado de la memoria alrededor de la dirección con errores: [33.477732] c1d03c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0 [33.478630] c1d03c80 : 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 [ 33.479526] >c1d03d00: 00 04 f2 f2 f2 f2 00 00 00 00 00 00 f1 f1 f1 f1 [ 33.480415] ^ [ 3.481195] c1d03d80: 00 00 00 00 00 00 00 00 00 00 04 f3 f3 f3 f3 f3 [ 33.482088] c1d03e00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.482978] === ==================================================== ==== Descubrimos que la causa principal de este OOB es que el brazo no elimina el veneno de la pila obsoleta en el caso de cpuidle. Este parche hace referencia a arch/arm64/kernel/sleep.S para resolver este problema. Del compromiso citado [1] que explica el problema. Las funciones que el compilador ha instrumentado para KASAN colocan veneno en la sombra de la pila al ingresar y eliminan este veneno antes de regresar. • https://git.kernel.org/stable/c/5615f69bc2097452ecc954f5264d784e158d6801 https://git.kernel.org/stable/c/20ac71bee028ffbae4fc14ed679b23b4d3e95726 https://git.kernel.org/stable/c/ad702338fe423cb1e79745787090317256a98dab https://git.kernel.org/stable/c/ee0ce7573e5083031960faf602c9db693ab5b477 https://git.kernel.org/stable/c/b26f353786d365e658cebc9a9ace88e04fc2325e https://git.kernel.org/stable/c/c4238686f9093b98bd6245a348bcf059cdce23af •