Описание
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU
on every run. The vGIC list register save and restore use used_lrs as
their loop bound and expect it to stay within the number of implemented
list registers. While this is generally the case, flush_hyp_vcpu()
copies vgic_v3 verbatim and does not enforce this, so a value provided
by the host is used at EL2 to index vgic_lr[] and access ICH_LR_EL2
(host -> EL2).
Fix by clamping used_lrs to the number of implemented list registers
after the copy, as the trusted path already does in
vgic_flush_lr_state(). The number of implemented list registers is
constant after init, so it is replicated once from
kvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on
every entry.
A flaw was found in the Kernel-based Virtual Machine (KVM) component of the Linux kernel on ARM64 systems. A highly privileged local attacker could exploit a vulnerability where the system fails to properly restrict memory access during a specific virtual machine operation. This could allow the attacker to read or write to sensitive memory areas, potentially leading to privilege escalation, where they gain unauthorized higher access, or cause a system crash (denial of service).
Отчет
An out-of-bounds access flaw rated IMPORTANT was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem on ARM64 systems, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10 and the kernel packages in Red Hat In-Vehicle OS. When flushing the pKVM hypervisor's private vCPU state, flush_hyp_vcpu() copies the host vGIC state verbatim without enforcing that used_lrs stays within the number of implemented list registers, as the vGIC list register save and restore code expects. A highly privileged local attacker on the host could supply a crafted used_lrs value that is used at EL2 to index vgic_lr[] and access the ICH_LR_EL2 registers out of bounds, allowing the attacker to read or write sensitive hypervisor memory, potentially leading to privilege escalation or a system crash (denial of service). Red Hat rated this flaw as IMPORTANT with a CVSS score of 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), lower than the CVE.org score of 8.2, reflecting the high attack complexity and the local privileges required to manipulate the vGIC state. Fixes are being pursued through the affected product streams. Red Hat Enterprise Linux 6 and 7 ELS and the RHEL 9.2 z-stream kernels are not affected because the vulnerable code is not present.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Will not fix | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux 10 | kernel | Fixed | RHSA-2026:64775 | 08.09.2026 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2026:64808 | 08.09.2026 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2026:64808 | 08.09.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use used_lrs as their loop bound and expect it to stay within the number of implemented list registers. While this is generally the case, flush_hyp_vcpu() copies vgic_v3 verbatim and does not enforce this, so a value provided by the host is used at EL2 to index vgic_lr[] and access ICH_LR<n>_EL2 (host -> EL2). Fix by clamping used_lrs to the number of implemented list registers after the copy, as the trusted path already does in vgic_flush_lr_state(). The number of implemented list registers is constant after init, so it is replicated once from kvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on every entry.
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU on every run. The vGIC list register save and restore use used_lrs as their loop bound and expect it to stay within the number of implemented list registers. While this is generally the case, flush_hyp_vcpu() copies vgic_v3 verbatim and does not enforce this, so a value provided by the host is used at EL2 to index vgic_lr[] and access ICH_LR<n>_EL2 (host -> EL2). Fix by clamping used_lrs to the number of implemented list registers after the copy, as the trusted path already does in vgic_flush_lr_state(). The number of implemented list registers is constant after init, so it is replicated once from kvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on every entry.
KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
In the Linux kernel, the following vulnerability has been resolved: K ...
EPSS
7 High
CVSS3