Bug 2324612 (CVE-2024-50192)

Summary: CVE-2024-50192 kernel: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: dfreiber, drow, jburrell, msalter, vkumar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2325161    
Bug Blocks:    

Description OSIDB Bzimport 2024-11-08 13:48:25 UTC 
In the Linux kernel, the following vulnerability has been resolved:

irqchip/gic-v4: Don't allow a VMOVP on a dying VPE

Kunkun Jiang reported that there is a small window of opportunity for
userspace to force a change of affinity for a VPE while the VPE has already
been unmapped, but the corresponding doorbell interrupt still visible in
/proc/irq/.

Plug the race by checking the value of vmapp_count, which tracks whether
the VPE is mapped ot not, and returning an error in this case.

This involves making vmapp_count common to both GICv4.1 and its v4.0
ancestor.
Comment 1 Mauro Matteo Cascella 2024-11-11 10:34:39 UTC 
Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/.CVE-2024-50192mbox
Comment 2 Mark Salter 2024-11-20 13:13:23 UTC 
Correct URL for upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-50192.mbox
Comment 6 errata-xmlrpc 2024-12-11 00:38:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:10944 https://access.redhat.com/errata/RHSA-2024:10944
Comment 7 errata-xmlrpc 2024-12-11 01:09:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:10943 https://access.redhat.com/errata/RHSA-2024:10943
Comment 8 errata-xmlrpc 2024-12-19 00:43:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:11486 https://access.redhat.com/errata/RHSA-2024:11486
Comment 9 errata-xmlrpc 2025-04-16 03:11:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:3935 https://access.redhat.com/errata/RHSA-2025:3935