Linux Kernel up to 6.11.4 gic-v4 vmapp_count privilege escalation

Summaryinfo

A vulnerability labeled as problematic has been found in Linux Kernel up to 5.10.227/5.15.168/6.1.113/6.6.57/6.11.4. Affected is the function vmapp_count of the component gic-v4. The manipulation results in an unknown weakness. This vulnerability is cataloged as CVE-2024-50192. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.10.227/5.15.168/6.1.113/6.6.57/6.11.4. It has been classified as problematic. Affected is the function vmapp_count of the component gic-v4. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE Kunkun Jiang reported that there is a small window of opportunity for userspace to force a change of affinity for a VPE while the VPE has already been unmapped, but the corresponding doorbell interrupt still visible in /proc/irq/. Plug the race by checking the value of vmapp_count, which tracks whether the VPE is mapped ot not, and returning an error in this case. This involves making vmapp_count common to both GICv4.1 and its v4.0 ancestor.

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2024-50192 since 10/21/2024. The exploitability is told to be difficult. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 212412 (RHEL 8 : kernel-rt (RHSA-2024:10944)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.10.228, 5.15.169, 6.1.114, 6.6.58 or 6.11.5 eliminates this vulnerability. Applying the patch b7d7b7fc876f/755b9532c885/64b12b061c54/01282ab5182f/d960505a869e/1442ee001198 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (212412). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.10.227
• 5.15.168
• 6.1.113
• 6.6.0
• 6.6.1
• 6.6.2
• 6.6.3
• 6.6.4
• 6.6.5
• 6.6.6
• 6.6.7
• 6.6.8
• 6.6.9
• 6.6.10
• 6.6.11
• 6.6.12
• 6.6.13
• 6.6.14
• 6.6.15
• 6.6.16
• 6.6.17
• 6.6.18
• 6.6.19
• 6.6.20
• 6.6.21
• 6.6.22
• 6.6.23
• 6.6.24
• 6.6.25
• 6.6.26
• 6.6.27
• 6.6.28
• 6.6.29
• 6.6.30
• 6.6.31
• 6.6.32
• 6.6.33
• 6.6.34
• 6.6.35
• 6.6.36
• 6.6.37
• 6.6.38
• 6.6.39
• 6.6.40
• 6.6.41
• 6.6.42
• 6.6.43
• 6.6.44
• 6.6.45
• 6.6.46
• 6.6.47
• 6.6.48
• 6.6.49
• 6.6.50
• 6.6.51
• 6.6.52
• 6.6.53
• 6.6.54
• 6.6.55
• 6.6.56
• 6.6.57
• 6.11.0
• 6.11.1
• 6.11.2
• 6.11.3
• 6.11.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion