CVE-2024-40989 (GCVE-0-2024-40989)
Vulnerability from cvelistv5
Published
2024-07-12 12:37
Modified
2026-08-05 11:34
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Disassociate vcpus from redistributor region on teardown When tearing down a redistributor region, make sure we don't have any dangling pointer to that region stored in a vcpu.
References
Impacted products
Vendor Product Version
Linux Linux Version: e5a35635464bc5304674b84ea42615a3fd0bd949
Version: e5a35635464bc5304674b84ea42615a3fd0bd949
Version: e5a35635464bc5304674b84ea42615a3fd0bd949
Version: e5a35635464bc5304674b84ea42615a3fd0bd949
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:58:53.765Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40989",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:01:54.595799Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:20.480Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/vgic/vgic-init.c",
            "arch/arm64/kvm/vgic/vgic-mmio-v3.c",
            "arch/arm64/kvm/vgic/vgic.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "68df4fc449fcc24347209e500ce26d5816705a77",
              "status": "affected",
              "version": "e5a35635464bc5304674b84ea42615a3fd0bd949",
              "versionType": "git"
            },
            {
              "lessThan": "48bb62859d47c5c4197a8c01128d0fa4f46ee58c",
              "status": "affected",
              "version": "e5a35635464bc5304674b84ea42615a3fd0bd949",
              "versionType": "git"
            },
            {
              "lessThan": "152b4123f21e6aff31cea01158176ad96a999c76",
              "status": "affected",
              "version": "e5a35635464bc5304674b84ea42615a3fd0bd949",
              "versionType": "git"
            },
            {
              "lessThan": "0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8",
              "status": "affected",
              "version": "e5a35635464bc5304674b84ea42615a3fd0bd949",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/vgic/vgic-init.c",
            "arch/arm64/kvm/vgic/vgic-mmio-v3.c",
            "arch/arm64/kvm/vgic/vgic.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.96",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.36",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.7",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Disassociate vcpus from redistributor region on teardown\n\nWhen tearing down a redistributor region, make sure we don\u0027t have\nany dangling pointer to that region stored in a vcpu."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The entire attack is a sequence of ioctls on /dev/kvm and the resulting VM/vCPU/vgic-device file descriptors (KVM_CREATE_DEVICE, KVM_SET_DEVICE_ATTR, KVM_RUN, KVM_GET_DEVICE_ATTR); no network, adjacent-network, or physical path reaches arch/arm64/kvm/vgic.\nAC:L - No race and no unpredictable state is involved \u2014 the attacker deterministically forces the free (redist region with count \u003c nr_vcpus followed by a failing first KVM_RUN, or MMIO-bus exhaustion via ~1000 ioeventfds to make kvm_io_bus_register_dev return -ENOSPC), then re-inits the vgic and reads GICR_TYPER at will, with unlimited time to groom and spray the reclaimed kmalloc-cg-64 slot.\nPR:L - Creating a VM, a KVM_DEV_TYPE_ARM_VGIC_V3 device and vCPUs requires no capability at all \u2014 only the ability to open /dev/kvm, which is world-accessible (0666 udev rule) or kvm-group on mainstream distros and is exposed to unprivileged app-domain virtualization on Android/AVF.\nUI:N - The attacker performs the region setup, the failing KVM_RUN, the re-init and the GICR_TYPER read entirely within its own process; no victim action, mount, or file open is required.\nS:U - The free is only reachable from the host VMM process, not from guest code, so the attacker and the corrupted host kernel heap are in the same security authority \u2014 this is standard local kernel privilege escalation, not a guest-to-host escape.\nC:H - vgic_mmio_vcpu_rdist_is_last() dereferences a stale pointer into a freed, reclaimed kmalloc-cg-64 object, reading base/count/free_index from whatever heap data now occupies that slot; per kernel scoring guidance a use-after-free read of reclaimed slab memory is treated as High, and the resulting GICR_TYPER_LAST bit forms a repeatable oracle over sprayed heap contents.\nI:H - The bug leaves a permanently dangling kernel heap pointer in vcpu-\u003earch.vgic_cpu.rdreg that survives arbitrary reallocation of that slab object, which is the canonical memory-corruption primitive class; the stale dereference also feeds falsified redistributor topology into GICR_TYPER as seen by the guest and by the migration save/restore stream.\nA:H - Dereferencing freed slab memory produces a KASAN use-after-free splat (fatal under panic_on_warn) and can oops outright if the backing page has been returned to the allocator, and the attacker can re-trigger the GICR_TYPER read arbitrarily often."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:27.078Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77"
        },
        {
          "url": "https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c"
        },
        {
          "url": "https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8"
        }
      ],
      "title": "KVM: arm64: Disassociate vcpus from redistributor region on teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40989",
    "datePublished": "2024-07-12T12:37:33.823Z",
    "dateReserved": "2024-07-12T12:17:45.605Z",
    "dateUpdated": "2026-08-05T11:34:27.078Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:58:53.765Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40989\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:01:54.595799Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:22.092Z\"}}], \"cna\": {\"title\": \"KVM: arm64: Disassociate vcpus from redistributor region on teardown\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e5a35635464bc5304674b84ea42615a3fd0bd949\", \"lessThan\": \"68df4fc449fcc24347209e500ce26d5816705a77\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e5a35635464bc5304674b84ea42615a3fd0bd949\", \"lessThan\": \"48bb62859d47c5c4197a8c01128d0fa4f46ee58c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e5a35635464bc5304674b84ea42615a3fd0bd949\", \"lessThan\": \"152b4123f21e6aff31cea01158176ad96a999c76\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e5a35635464bc5304674b84ea42615a3fd0bd949\", \"lessThan\": \"0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/arm64/kvm/vgic/vgic-init.c\", \"arch/arm64/kvm/vgic/vgic-mmio-v3.c\", \"arch/arm64/kvm/vgic/vgic.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.96\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.36\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/arm64/kvm/vgic/vgic-init.c\", \"arch/arm64/kvm/vgic/vgic-mmio-v3.c\", \"arch/arm64/kvm/vgic/vgic.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77\"}, {\"url\": \"https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c\"}, {\"url\": \"https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76\"}, {\"url\": \"https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: arm64: Disassociate vcpus from redistributor region on teardown\\n\\nWhen tearing down a redistributor region, make sure we don\u0027t have\\nany dangling pointer to that region stored in a vcpu.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.96\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.36\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.7\", \"versionStartIncluding\": \"5.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:23:43.682Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40989\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:23:43.682Z\", \"dateReserved\": \"2024-07-12T12:17:45.605Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:37:33.823Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.