KVM Memory Attribute Overflow Vulnerability in Linux Kernel (CVE-2024-26991)
Summary
DEBIAN-CVE-2024-26991: In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes Fix KVM_SET_MEMORY_ATTRIBUTES to not overflow lpage_info array and trigger KASAN s... Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, managing hardware resources and providing essential services for applications. It supports a wide range of functionalities, including process management, memory management, and device control. This vulnerability specifically affects the KVM (Kernel-based Virtual Machine) subsystem, which allows the Linux kernel to function as a hypervisor for running virtual machines. The vulnerability arises from improper handling of memory attributes, leading to potential memory corruption and system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the KVM subsystem related to the handling of memory attributes. The issue occurs when the KVM_SET_MEMORY_ATTRIBUTES ioctl is called, which updates the lpage_info array for memory slots with mismatched attributes. This can lead to an overflow in the level - 1 kvm_lpage_info array, resulting in a vmalloc out-of-bounds read. The vulnerability can be exploited during the execution of the private_mem_conversions_test selftest, potentially leading to memory corruption and system crashes. The specific technical details involve the mishandling of huge page attributes and the KVM_LPAGE_MIXED_FLAG, which can cause inconsistencies in memory management.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may avoid using huge pages or refrain from setting memory attributes on GFN ranges until the kernel is updated to a secure version. However, this may impact performance and should only be considered until a proper fix is applied.
Conclusion
The CVE-2024-26991 vulnerability in the Linux kernel's KVM subsystem poses a significant risk due to improper handling of memory attributes, leading to potential memory corruption. Users are advised to update to the latest patched version of the kernel to mitigate this risk. For those unable to update immediately, temporary workarounds are available, but they may affect system performance.
See every vulnerability recorded for linux →
FAQ
CVE-2024-26991 is a vulnerability in the Linux kernel's KVM subsystem that can lead to memory corruption due to improper handling of memory attributes.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities in real-time.
Exploitation of this vulnerability can lead to memory corruption, system crashes, and instability in virtual machines managed by KVM.
Yes, a patch has been released in version 6.8.9-1 of the Linux kernel. Users should update to this version or later to mitigate the vulnerability.
As a temporary measure, avoid using huge pages or setting memory attributes on GFN ranges until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
