Tracker / CVE-2024-36953
CVE-2024-36953
Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() vgic_v2_parse_attr() is responsible for finding the vCPU that matches the user-provided CPUID, which (of course) may not be valid. If the ID is invalid, kvm_get_vcpu_by_id() returns NULL, which isn't handled gracefully. Similar to the GICv3 uaccess flow, check that kvm_get_vcpu_by_id() actually returns something and fail the ioctl if not.
Affected products and versions
| debian | debian_linux |
|---|---|
| linux | linux_kernel |
| linux | linux_kernel · 4.7 → 5.10.217 |
| linux | linux_kernel · 5.11 → 5.15.159 |
| linux | linux_kernel · 5.16 → 6.1.91 |
| linux | linux_kernel · 6.2 → 6.6.31 |
| linux | linux_kernel · 6.7 → 6.8.10 |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.