In the Linux kernel, the following vulnerability has been resolved:
LoongArch: KVM: Validate MSI data before routing it to EIOINTC
pch_msi_set_irq() passes e->msi.data straight into eiointc_set_irq() as
the irq number. The MSI data comes from userspace, that either via a
KVM_IRQ_ROUTING_MSI entry set with KVM_SET_GSI_ROUTING (used by irqfd
and KVM_IRQ_LINE) or directly via KVM_SIGNAL_MSI, and is never checked
against EIOINTC_IRQS.
eiointc_set_irq() uses the value with __set_bit()/__clear_bit() on the
256-bit isr bitmap, eiointc_update_irq() then indexes sw_coremap[] and
the per-cpu coreisr/sw_coreisr bitmaps with it. Therefore a data value
= 256 reads and writes memory past the end of those arrays, i.e. any
process holding a VM fd can corrupt kernel memory beyond the allocation
of loongarch_eiointc.
Reject MSI data that doesn't fit in the EIOINTC irq space. The DMSINTC
path is unaffected as it decodes the vector from the address and masks
it.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 8.8
AV:L - pch_msi_set_irq() is reached only via local KVM VM-fd ioctls on /dev/kvm: KVM_SIGNAL_MSI, or KVM_SET_GSI_ROUTING with a KVM_IRQ_ROUTING_MSI entry then irqfd/KVM_IRQ_LINE. No network, Bluetooth, or physical path supplies the unbounded MSI data.
AC:L - A single KVM_SIGNAL_MSI (or irqfd injection after installing a KVM_IRQ_ROUTING_MSI entry) with attacker-chosen msi.data >= 256 deterministically drives __set_bit()/__clear_bit() on isr and indexes sw_coremap[] past EIOINTC_IRQS; the attacker fully controls the irq index with no race or uncontrollable layout.
PR:L - Exploitation requires only opening /dev/kvm and holding a VM fd (kvm-group membership on typical LoongArch hosts, or equivalent unprivileged VM access), then creating the in-kernel EIOINTC/PCH-PIC/IPI devices. Init-namespace root is not required.
UI:N - No victim interaction is required. The attacker creates the in-kernel LoongArch irqchip devices on a VM they control and issues KVM_SIGNAL_MSI or irqfd themselves; no mount, file open, or other user action is needed.
S:C - A KVM VM operator corrupts host kernel memory beyond the loongarch_eiointc allocation from the KVM userspace interface, crossing the VM-to-host virtualization boundary rather than confining impact to the attacker's VM security scope.
C:H - Unbounded msi.data causes out-of-bounds __set_bit()/__clear_bit() on the 256-bit isr bitmap and an out-of-bounds sw_coremap[irq] read past the loongarch_eiointc object. Per kernel guidance such OOB memory corruption is High confidentiality impact.
I:H - The attacker fully controls the bit index via 32-bit MSI data, yielding arbitrary-offset bit set/clear from s->isr and further OOB writes into coreisr/sw_coreisr when a valid vCPU id is observed. That out-of-bounds write is usable for host privilege escalation.
A:H - Indexing the EIOINTC bitmaps and sw_coremap[] with irq >= 256 can immediately oops or panic the host kernel, and corrupting adjacent slab objects breaks later irq injection, denying service to the host and co-resident VMs.
| Attack Vector |
Local |
Scope |
Changed |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - pch_msi_set_irq() is reached only via local KVM VM-fd ioctls on /dev/kvm: KVM_SIGNAL_MSI, or KVM_SET_GSI_ROUTING with a KVM_IRQ_ROUTING_MSI entry then irqfd/KVM_IRQ_LINE. No network, Bluetooth, or physical path supplies the unbounded MSI data.
AC:L - A single KVM_SIGNAL_MSI (or irqfd injection after installing a KVM_IRQ_ROUTING_MSI entry) with attacker-chosen msi.data >= 256 deterministically drives __set_bit()/__clear_bit() on isr and indexes sw_coremap[] past EIOINTC_IRQS; the attacker fully controls the irq index with no race or uncontrollable layout.
PR:L - Exploitation requires only opening /dev/kvm and holding a VM fd (kvm-group membership on typical LoongArch hosts, or equivalent unprivileged VM access), then creating the in-kernel EIOINTC/PCH-PIC/IPI devices. Init-namespace root is not required.
UI:N - No victim interaction is required. The attacker creates the in-kernel LoongArch irqchip devices on a VM they control and issues KVM_SIGNAL_MSI or irqfd themselves; no mount, file open, or other user action is needed.
S:C - A KVM VM operator corrupts host kernel memory beyond the loongarch_eiointc allocation from the KVM userspace interface, crossing the VM-to-host virtualization boundary rather than confining impact to the attacker's VM security scope.
C:H - Unbounded msi.data causes out-of-bounds __set_bit()/__clear_bit() on the 256-bit isr bitmap and an out-of-bounds sw_coremap[irq] read past the loongarch_eiointc object. Per kernel guidance such OOB memory corruption is High confidentiality impact.
I:H - The attacker fully controls the bit index via 32-bit MSI data, yielding arbitrary-offset bit set/clear from s->isr and further OOB writes into coreisr/sw_coreisr when a valid vCPU id is observed. That out-of-bounds write is usable for host privilege escalation.
A:H - Indexing the EIOINTC bitmaps and sw_coremap[] with irq >= 256 can immediately oops or panic the host kernel, and corrupting adjacent slab objects breaks later irq injection, denying service to the host and co-resident VMs.
CVSS 3.1