CVE-2024-50114

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Unregister redistributor for failed vCPU creation

Alex reports that syzkaller has managed to trigger a use-after-free when

tearing down a VM:

BUG: KASAN: slab-use-after-free in kvm_put_kvm+0x300/0xe68 virt/kvm/kvm_main.c:5769

Read of size 8 at addr ffffff801c6890d0 by task syz.3.2219/10758

CPU: 3 UID: 0 PID: 10758 Comm: syz.3.2219 Not tainted 6.11.0-rc6-dirty #64

Hardware name: linux,dummy-virt (DT)

Call trace:

dump_backtrace+0x17c/0x1a8 arch/arm64/kernel/stacktrace.c:317

show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:324

__dump_stack lib/dump_stack.c:93 [inline]

dump_stack_lvl+0x94/0xc0 lib/dump_stack.c:119

print_report+0x144/0x7a4 mm/kasan/report.c:377

kasan_report+0xcc/0x128 mm/kasan/report.c:601

__asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381

kvm_put_kvm+0x300/0xe68 virt/kvm/kvm_main.c:5769

kvm_vm_release+0x4c/0x60 virt/kvm/kvm_main.c:140

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References