CVE-2024-26687

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xen/events: close evtchn after mapping cleanup

shutdown_pirq and startup_pirq are not taking the

irq_mapping_update_lock because they can't due to lock inversion. Both

are called with the irq_desc->lock being taking. The lock order,

however, is first irq_mapping_update_lock and then irq_desc->lock.

This opens multiple races:

- shutdown_pirq can be interrupted by a function that allocates an event

channel:

CPU0 CPU1

shutdown_pirq {

xen_evtchn_close(e)

__startup_pirq {

EVTCHNOP_bind_pirq

-> returns just freed evtchn e

set_evtchn_to_irq(e, irq)

}

xen_irq_info_cleanup() {

set_evtchn_to_irq(e, -1)

}

}

Assume here event channel e refers here to the same event channel

number.

After this race the evtchn_to_irq ma

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References