Linux kernel (drivers/vfio/pci): An uninitialized stack variable is used as the device count when a tenant asks vfio

CVE-2024-41052Kernel, userspace & hypervisorcurated

Impact

An uninitialized stack variable is used as the device count when a tenant asks vfio which devices are in its PCI hot-reset group. The count returned is wrong and the caller crashes - and that same group enumeration is the data vfio works from when reasoning about which devices a bus reset would take with it.

Who can reach it

A tenant holding a vfio-pci device fd calling VFIO_DEVICE_GET_PCI_HOT_RESET_INFO. One plain ioctl, no race to win, no host root. Upstream's stated observable is a wrong device count and a userspace crash, not a demonstrated kernel write.

What to do

Update to 6.6.41 or 6.9.10 or later. Interim control: drop /dev/vfio device nodes from containers that do not need passthrough.

References

https://git.kernel.org/stable/c/f476dffc52ea70745dcabf63288e770e50ac9ab3 https://git.kernel.org/stable/c/f44136b9652291ac1fc39ca67c053ac624d0d11b https://nvd.nist.gov/vuln/detail/CVE-2024-41052

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.