CVE-2024-26620

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

s390/vfio-ap: always filter entire AP matrix

The vfio_ap_mdev_filter_matrix function is called whenever a new adapter or

domain is assigned to the mdev. The purpose of the function is to update

the guest's AP configuration by filtering the matrix of adapters and

domains assigned to the mdev. When an adapter or domain is assigned, only

the APQNs associated with the APID of the new adapter or APQI of the new

domain are inspected. If an APQN does not reference a queue device bound to

the vfio_ap device driver, then it's APID will be filtered from the mdev's

matrix when updating the guest's AP configuration.

Inspecting only the APID of the new adapter or APQI of the new domain will

result in passing AP queues through to a guest that are not bound to the

vfio_ap device driver under certain circumstances. Consider the following:

guest's AP configuration (all also assigned to the mdev's matrix):

14.0004

14.0005

14.0006

16

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References