KVM Vulnerability in Linux Package: Improper Management of Userspace IRQ Chip
Summary
DEBIAN-CVE-2024-53195: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Get rid of userspace_irqchip_in_use Improper use of userspace_irqchip_in_use led to syzbot hitting the following WARN_ON() in kvm_timer_upda... Affects linux versions < 6.12.3-1. Fixed in 6.12.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system, responsible for managing hardware resources and providing essential services to applications. It supports various architectures, including ARM, and is widely used in servers, desktops, and embedded systems. The vulnerability in question affects the KVM (Kernel-based Virtual Machine) subsystem, which allows users to run virtual machines on Linux. This specific issue arises from improper handling of the userspace IRQ chip, potentially leading to system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the KVM subsystem, specifically in the handling of the userspace IRQ chip. The issue stems from the improper use of the 'userspace_irqchip_in_use' variable, which can lead to a WARN_ON() trigger in the 'kvm_timer_update_irq()' function. This occurs when a virtual CPU (vCPU) is initialized without proper setup, causing the system to enter an inconsistent state. The vulnerability can be exploited if userspace ignores error messages and attempts to reinitialize the vCPU, potentially leading to system crashes or undefined behavior.
How To Fix
Minimum fixed version
6.12.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to avoid reinitializing the vCPU without proper setup to prevent triggering the WARN_ON() condition.
Conclusion
The identified vulnerability in the Linux kernel's KVM subsystem poses a risk of system instability due to improper management of the userspace IRQ chip. Users are encouraged to update their Linux packages to the patched version 6.12.3-1 to mitigate this risk. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system instability, crashes, or undefined behavior if exploited.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability affects the Linux package in Debian 13 and Debian 14 prior to version 6.12.3-1.
Yes, the patch is included in version 6.12.3-1 of the Linux package.
While there are no specific workarounds, it is advisable to avoid reinitializing the vCPU without proper setup until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
