CVE-2024-55916

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet

If the KVP (or VSS) daemon starts before the VMBus channel's ringbuffer is

fully initialized, we can hit the panic below:

hv_utils: Registering HyperV Utility Driver

hv_vmbus: registering driver hv_utils

...

BUG: kernel NULL pointer dereference, address: 0000000000000000

CPU: 44 UID: 0 PID: 2552 Comm: hv_kvp_daemon Tainted: G E 6.11.0-rc3+ #1

RIP: 0010:hv_pkt_iter_first+0x12/0xd0

Call Trace:

...

vmbus_recvpacket

hv_kvp_onchannelcallback

vmbus_on_event

tasklet_action_common

tasklet_action

handle_softirqs

irq_exit_rcu

sysvec_hyperv_stimer0

</IRQ>

<TASK>

asm_sysvec_hyperv_stimer0

...

kvp_register_done

hvt_op_read

vfs_read

ksys_read

__x64_sys_read

This can happen because the KVP/VSS channel callback can be invoked

even before the channel is fully opened:

1) as soon as hv_kvp_init() -> hvutil_transport_init() creates

/dev/vmbus/hv_kvp, t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References