Log in Start free

Vulnerability · Published Nov 21, 2024 · Assigned by Linux

CVE-2024-53092virtio_pci: Fix admin vq cleanup by using correct info pointer

High 8.4

In plain English

A high-severity null pointer dereference in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.2%top 89.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: virtio_pci: Fix admin vq cleanup by using correct info pointer vp_modern_avq_cleanup() and vp_del_vqs() clean up admin vq resources by virtio_pci_vq_info pointer. The info pointer of admin vq is stored in vp_dev->admin_vq.info instead of vp_dev->vqs[]. Using the info pointer from vp_dev->vqs[] for admin vq causes a kernel NULL pointer dereference bug. In vp_modern_avq_cleanup() and vp_del_vqs(), get the info pointer from vp_dev->admin_vq.info for admin vq to clean up the resources. Also make info ptr as argument of vp_del_vq() to be symmetric with vp_setup_vq(). vp_reset calls vp_modern_avq_cleanup, and causes the Call Trace: ================================================================== BUG: kernel NULL pointer dereference, address:0000000000000000 ... CPU: 49 UID: 0 PID: 4439 Comm: modprobe Not tainted 6.11.0-rc5 #1 RIP: 0010:vp_reset+0x57/0x90 [virtio_pci] Call Trace: <TASK> ... ? vp_reset+0x57/0x90 [virtio_pci] ? vp_reset+0x38/0x90 [virtio_pci] virtio_reset_device+0x1d/0x30 remove_vq_common+0x1c/0x1a0 [virtio_net] virtnet_remove+0xa1/0xc0 [virtio_net] virtio_dev_remove+0x46/0xa0 ... virtio_pci_driver_exit+0x14/0x810 [virtio_pci] ==================================================================

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.11.9-1DEBIAN-CVE-2024-53092
Debian:14linux6.11.9-1DEBIAN-CVE-2024-53092
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-53092
Ubuntu:24.04:LTSlinux-oem-6.116.11.0-1015.15UBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-53092
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-53092
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-53092

Affected products (as reported)

VendorProductVersions
Linux Linux 4c3b54af907e709609d3d8beca92d65e2f0cfd83 – before 018d3d4ad4be7fbc95d8a2367642a32d21df55c74c3b54af907e709609d3d8beca92d65e2f0cfd83 – before 97ee04feb682c906a1fa973ebe586fe91567d165
Linux Linux 6.11

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References