Executive Summary

This vulnerability exists in the Linux kernel's KVM (Kernel-based Virtual Machine) for the arm64 architecture. It involves the handling of the nested_mmus array, which is accessed under a lock called mmu_lock. The issue arises because the nested_mmus array can be walked (accessed) under this lock, including during MMU notifier operations that can occur at any time. However, the function kvm_vcpu_init_nested() reallocates this array and frees the old buffer while holding a different lock (config_lock), not the mmu_lock. This means that the array can be freed while another process is still accessing it, leading to a use-after-free condition. The fix involves allocating the new array outside the mmu_lock, copying entries and reassigning the array under the lock, and freeing the old buffer only after releasing the lock, preventing access to freed memory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a use-after-free condition in the Linux kernel's KVM subsystem on arm64. Such a condition may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges. This could compromise the security and stability of virtual machines running on affected systems.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved in the Linux kernel by properly reallocating and reassigning the nested_mmus array with correct locking to avoid use-after-free conditions.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0