CVE-2024-40953

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()

Use {READ,WRITE}_ONCE() to access kvm->last_boosted_vcpu to ensure the

loads and stores are atomic. In the extremely unlikely scenario the

compiler tears the stores, it's theoretically possible for KVM to attempt

to get a vCPU using an out-of-bounds index, e.g. if the write is split

into multiple 8-bit stores, and is paired with a 32-bit load on a VM with

257 vCPUs:

CPU0 CPU1

last_boosted_vcpu = 0xff;

(last_boosted_vcpu = 0x100)

last_boosted_vcpu[15:8] = 0x01;

i = (last_boosted_vcpu = 0x1ff)

last_boosted_vcpu[7:0] = 0x00;

vcpu = kvm->vcpu_array[0x1ff];

As detected by KCSAN:

BUG: KCSAN: data-race in kvm_vcpu_on_spin [kvm] / kvm_vcpu_on_spin [kvm]

write to 0xffffc90025a92344 of 4 bytes by task 4340 on c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References