Linux i915 GVT-g mediated GPU virtualisation: Unsafe cleanup of per-vGPU debugfs state when a mediated vGPU is

Impact

Unsafe cleanup of per-vGPU debugfs state when a mediated vGPU is destroyed. GVT-g is the mechanism that carves one physical Intel GPU into vGPUs handed to different VMs, so bugs in its lifecycle paths sit directly on the tenant boundary. Practical effect here is a host kernel crash triggered by a vGPU teardown.

Who can reach it

Reachable by whoever can cause a vGPU to be created and destroyed - the virtualisation control plane, or a tenant that can start and stop VMs.

What to do

Fix ships in the Linux kernel. Update the kernel and reboot the node - in practice this is a drain plus reboot because the accelerator driver cannot be unloaded while jobs hold device file descriptors. No BIOS or firmware update needed.

References

Related entries

• Citrix NetScaler ADC/Gateway: Code injection on the management interfaceCVE-2023-6548 · Citrix NetScaler ADC/GatewayMedium
• Linux nfsd (NFS server): Broken RELEASE_LOCKOWNER handling in nfsd causing state corruptionCVE-2024-26629 · Linux nfsd (NFS server)Medium
• Intel Neural Compressor: Input-validation failure reachable by an authenticated user, ending in privilege escalationCVE-2024-36284 · Intel Neural CompressorMedium
• AMD Graphics Driver - integer overflow bypassing size checks: An integer overflow in the AMD graphics driver letsCVE-2024-36316 · AMD Graphics Driver - integer overflow bypassing size checksMedium
• Linux cpufreq/amd-pstate - memory leak on CPU EPP exit: The amd-pstate driver leaks its per-CPU allocation when a CPU'sCVE-2024-40997 · Linux cpufreq/amd-pstate - memory leak on CPU EPP exitMedium
• Linux cpufreq/amd-pstate - unchecked cpufreq_cpu_get() return value: cpufreq_cpu_get() can return NULL and amd-pstateCVE-2024-50009 · Linux cpufreq/amd-pstate - unchecked cpufreq_cpu_get() return valueMedium