Critical Vulnerability in Linux Kernel: KVM S390 Validity Interception Issue
Summary
DEBIAN-CVE-2024-45005: In the Linux kernel, the following vulnerability has been resolved: KVM: s390: fix validity interception issue when gisa is switched off We might run into a SIE validity if gisa has been disabled either via using kernel... Affects linux versions < 6.10.7-1. Fixed in 6.10.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to applications. It supports various architectures, including S390, which is used in IBM mainframes. This vulnerability affects the KVM (Kernel-based Virtual Machine) module, specifically when the GISA (Guest Interrupt Service Area) is disabled, leading to potential system instability and security risks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the KVM module for S390 architecture, where an invalid value in the SIE (System Instruction Execution) control block's GISA designation can occur if GISA is disabled. This situation arises when the uninitialized GISA origin is passed to the virt_to_phys() function before being set in the GISA designation. The consequence is an unhandled validity intercept, which can lead to system crashes or unexpected behavior when starting a new KVM guest. The kernel message indicating this issue is 'kvm: unhandled validity intercept 0x1011'.
How To Fix
Minimum fixed version
6.10.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid disabling GISA by not using the kernel parameter 'kvm.use_gisa=0' or by ensuring that the related sysfs attribute is not set to N (do not execute 'echo N > /sys/module/kvm/parameters/use_gisa'). This will prevent the vulnerability from being triggered.
Conclusion
The vulnerability in the Linux kernel's KVM module for S390 architecture poses significant risks, including system instability and crashes. It is crucial to update to the patched version to mitigate these risks. Temporary workarounds are available, but the best course of action is to apply the update as soon as possible.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes or unexpected behavior when starting new KVM guests, potentially compromising system stability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, the permanent fix is to update the Linux package to version 6.10.7-1 or later, which addresses the vulnerability.
If immediate updates are not possible, avoid disabling GISA as a temporary workaround to prevent the vulnerability from being triggered.
More details can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-45005.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
