CVE-2024-47727

Summary

In the Linux kernel, the following vulnerability has been resolved: x86/tdx: Fix "in-kernel MMIO" check TDX only supports kernel-initiated MMIO operations. The handle_mmio() function checks if the #VE exception occurred in the kernel and rejects the operation if it did not. However, userspace can deceive the kernel into performing MMIO on its behalf. For example, if userspace can point a syscall to an MMIO address, syscall does get_user() or put_user() on it, triggering MMIO #VE. The kernel will treat the #VE as in-kernel MMIO. Ensure that the target MMIO address is within the kernel before decoding instruction.

Impact & exploitability

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: https://git.kernel.org/stable/c/18ecd5b74682839e7cdafb7cd1ec106df7baa18c ↗

Additional information

• NVD record
• https://git.kernel.org/stable/c/18ecd5b74682839e7cdafb7cd1ec106df7baa18cPatch
• https://git.kernel.org/stable/c/25703a3c980e21548774eea8c8a87a75c5c8f58cPatch
• https://git.kernel.org/stable/c/4c0c5dcb5471de5fc8f0a1c4980e5815339e1ceePatch
• https://git.kernel.org/stable/c/bca2e29f7e26ce7c3522f8b324c0bd85612f68e3Patch
• https://git.kernel.org/stable/c/d4fc4d01471528da8a9797a065982e05090e1d81Patch
• https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html