CVE-2024-26620
s390/vfio-ap: always filter entire AP matrix
Description
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: always filter entire AP matrix The vfio_ap_mdev_filter_matrix function is called whenever a new adapter or domain is assigned to the mdev. The purpose of the function is to update the guest's AP configuration by filtering the matrix of adapters and domains assigned to the mdev. When an adapter or domain is assigned, only the APQNs associated with the APID of the new adapter or APQI of the new domain are inspected. If an APQN does not reference a queue device bound to the vfio_ap device driver, then it's APID will be filtered from the mdev's matrix when updating the guest's AP configuration. Inspecting only the APID of the new adapter or APQI of the new domain will result in passing AP queues through to a guest that are not bound to the vfio_ap device driver under certain circumstances. Consider the following: guest's AP configuration (all also assigned to the mdev's matrix): 14.0004 14.0005 14.0006 16.0004 16.0005 16.0006 unassign domain 4 unbind queue 16.0005 assign domain 4 When domain 4 is re-assigned, since only domain 4 will be inspected, the APQNs that will be examined will be: 14.0004 16.0004 Since both of those APQNs reference queue devices that are bound to the vfio_ap device driver, nothing will get filtered from the mdev's matrix when updating the guest's AP configuration. Consequently, queue 16.0005 will get passed through despite not being bound to the driver. This violates the linux device model requirement that a guest shall only be given access to devices bound to the device driver facilitating their pass-through. To resolve this problem, every adapter and domain assigned to the mdev will be inspected when filtering the mdev's matrix.
INFO
Published Date :
March 11, 2024, 6:15 p.m.
Last Modified :
Feb. 14, 2025, 4:39 p.m.
Remotely Exploit :
Yes !
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update the Linux kernel packages.
- Reboot the system for changes to take effect.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-26620.
| URL | Resource |
|---|---|
| https://git.kernel.org/stable/c/850fb7fa8c684a4c6bf0e4b6978f4ddcc5d43d11 | Mailing List Patch |
| https://git.kernel.org/stable/c/c69d821197611678533fb3eb784fc823b921349a | Mailing List Patch |
| https://git.kernel.org/stable/c/cdd134d56138302976685e6c7bc4755450b3880e | Mailing List Patch |
| https://git.kernel.org/stable/c/d6b8d034b576f406af920a7bee81606c027b24c6 | Mailing List Patch |
| https://git.kernel.org/stable/c/850fb7fa8c684a4c6bf0e4b6978f4ddcc5d43d11 | Mailing List Patch |
| https://git.kernel.org/stable/c/c69d821197611678533fb3eb784fc823b921349a | Mailing List Patch |
| https://git.kernel.org/stable/c/cdd134d56138302976685e6c7bc4755450b3880e | Mailing List Patch |
| https://git.kernel.org/stable/c/d6b8d034b576f406af920a7bee81606c027b24c6 | Mailing List Patch |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-26620 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-26620
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-26620 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-26620 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Feb. 14, 2025
Action Type Old Value New Value Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Added CWE NIST CWE-787 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.0 up to (excluding) 6.1.76 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.15 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.7.3 Changed Reference Type https://git.kernel.org/stable/c/850fb7fa8c684a4c6bf0e4b6978f4ddcc5d43d11 No Types Assigned https://git.kernel.org/stable/c/850fb7fa8c684a4c6bf0e4b6978f4ddcc5d43d11 Mailing List, Patch Changed Reference Type https://git.kernel.org/stable/c/850fb7fa8c684a4c6bf0e4b6978f4ddcc5d43d11 No Types Assigned https://git.kernel.org/stable/c/850fb7fa8c684a4c6bf0e4b6978f4ddcc5d43d11 Mailing List, Patch Changed Reference Type https://git.kernel.org/stable/c/c69d821197611678533fb3eb784fc823b921349a No Types Assigned https://git.kernel.org/stable/c/c69d821197611678533fb3eb784fc823b921349a Mailing List, Patch Changed Reference Type https://git.kernel.org/stable/c/c69d821197611678533fb3eb784fc823b921349a No Types Assigned https://git.kernel.org/stable/c/c69d821197611678533fb3eb784fc823b921349a Mailing List, Patch Changed Reference Type https://git.kernel.org/stable/c/cdd134d56138302976685e6c7bc4755450b3880e No Types Assigned https://git.kernel.org/stable/c/cdd134d56138302976685e6c7bc4755450b3880e Mailing List, Patch Changed Reference Type https://git.kernel.org/stable/c/cdd134d56138302976685e6c7bc4755450b3880e No Types Assigned https://git.kernel.org/stable/c/cdd134d56138302976685e6c7bc4755450b3880e Mailing List, Patch Changed Reference Type https://git.kernel.org/stable/c/d6b8d034b576f406af920a7bee81606c027b24c6 No Types Assigned https://git.kernel.org/stable/c/d6b8d034b576f406af920a7bee81606c027b24c6 Mailing List, Patch Changed Reference Type https://git.kernel.org/stable/c/d6b8d034b576f406af920a7bee81606c027b24c6 No Types Assigned https://git.kernel.org/stable/c/d6b8d034b576f406af920a7bee81606c027b24c6 Mailing List, Patch -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/850fb7fa8c684a4c6bf0e4b6978f4ddcc5d43d11 Added Reference https://git.kernel.org/stable/c/c69d821197611678533fb3eb784fc823b921349a Added Reference https://git.kernel.org/stable/c/cdd134d56138302976685e6c7bc4755450b3880e Added Reference https://git.kernel.org/stable/c/d6b8d034b576f406af920a7bee81606c027b24c6 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 29, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2024
Action Type Old Value New Value -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Mar. 11, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: always filter entire AP matrix The vfio_ap_mdev_filter_matrix function is called whenever a new adapter or domain is assigned to the mdev. The purpose of the function is to update the guest's AP configuration by filtering the matrix of adapters and domains assigned to the mdev. When an adapter or domain is assigned, only the APQNs associated with the APID of the new adapter or APQI of the new domain are inspected. If an APQN does not reference a queue device bound to the vfio_ap device driver, then it's APID will be filtered from the mdev's matrix when updating the guest's AP configuration. Inspecting only the APID of the new adapter or APQI of the new domain will result in passing AP queues through to a guest that are not bound to the vfio_ap device driver under certain circumstances. Consider the following: guest's AP configuration (all also assigned to the mdev's matrix): 14.0004 14.0005 14.0006 16.0004 16.0005 16.0006 unassign domain 4 unbind queue 16.0005 assign domain 4 When domain 4 is re-assigned, since only domain 4 will be inspected, the APQNs that will be examined will be: 14.0004 16.0004 Since both of those APQNs reference queue devices that are bound to the vfio_ap device driver, nothing will get filtered from the mdev's matrix when updating the guest's AP configuration. Consequently, queue 16.0005 will get passed through despite not being bound to the driver. This violates the linux device model requirement that a guest shall only be given access to devices bound to the device driver facilitating their pass-through. To resolve this problem, every adapter and domain assigned to the mdev will be inspected when filtering the mdev's matrix. Added Reference Linux https://git.kernel.org/stable/c/d6b8d034b576f406af920a7bee81606c027b24c6 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/c69d821197611678533fb3eb784fc823b921349a [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/cdd134d56138302976685e6c7bc4755450b3880e [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/850fb7fa8c684a4c6bf0e4b6978f4ddcc5d43d11 [No types assigned]