In the Linux kernel, the following vulnerability has been resolved:
LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc
Variable vector[] is declared on stack in function dmsintc_inject_irq()
and sometimes it is used without initialized. Here fix this issue.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS Score: 7.3
AV:L - The uninitialized vector[] is used in dmsintc_inject_irq(), called from kvm_deliver_intr() on KVM_RUN (kvm_pre_enter_guest) and KVM_GET_ONE_REG ESTAT after irqfd/KVM_SIGNAL_MSI or KVM_INTERRUPT queues INT_AVEC. That is a local /dev/kvm and guest MSI path, not a network or physical protocol handler.
AC:L - A kvm-group VMM can create a MSGINT vCPU, queue INT_AVEC via KVM_INTERRUPT or irqfd MSI, then KVM_RUN or GET_ONE_REG ESTAT; any zero vector_map word leaves the matching stack slot uninitialized and typically nonzero. A guest retriggers the same inject on ordinary virtio/MSI I/O with no race.
PR:L - kvm_dev_ioctl_create_vm() has no capable() check, so kvm-group (or equivalent) access is enough to create dmsintc, enable CPUCFG MSGINT, and inject AVEC. A LoongArch KVM tenant can also cause irqfd MSI injection and read guest ISR CSRs, which is Low privilege relative to the hypervisor, not init-namespace root.
UI:N - The attacker issues KVM ioctls or guest device I/O themselves; no separate victim action such as mounting a filesystem or opening a file is required.
S:C - dmsintc_inject_irq() writes host kernel stack contents into hardware guest ISR CSRs (LOONGARCH_CSR_ISR0-3) that the guest can read with csrrd and that the VMM can read after vcpu_put. That discloses hypervisor memory across the KVM guest-to-host boundary.
C:H - Up to four uninitialized unsigned long stack slots are OR'd into guest-visible ISR registers on every AVEC injection. Repeated MSI or KVM_RUN samples resample kernel stack including pointers, matching CNA stack-leak scoring for KASLR defeat.
I:L - The same uninitialized words are OR'd into guest ISR0-3, setting extra AVEC pending bits the VMM did not inject. That is limited corruption of guest interrupt-controller state, not an arbitrary host write or control-flow hijack.
A:N - The uninitialized values are consumed only as ISR bitmasks via gcsr_write; they are not used as pointers and do not oops, panic, hang, or otherwise deny host service.
| Attack Vector |
Local |
Scope |
Changed |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
Low |
| User Interaction |
None |
Availability Impact |
None |
AV:L - The uninitialized vector[] is used in dmsintc_inject_irq(), called from kvm_deliver_intr() on KVM_RUN (kvm_pre_enter_guest) and KVM_GET_ONE_REG ESTAT after irqfd/KVM_SIGNAL_MSI or KVM_INTERRUPT queues INT_AVEC. That is a local /dev/kvm and guest MSI path, not a network or physical protocol handler.
AC:L - A kvm-group VMM can create a MSGINT vCPU, queue INT_AVEC via KVM_INTERRUPT or irqfd MSI, then KVM_RUN or GET_ONE_REG ESTAT; any zero vector_map word leaves the matching stack slot uninitialized and typically nonzero. A guest retriggers the same inject on ordinary virtio/MSI I/O with no race.
PR:L - kvm_dev_ioctl_create_vm() has no capable() check, so kvm-group (or equivalent) access is enough to create dmsintc, enable CPUCFG MSGINT, and inject AVEC. A LoongArch KVM tenant can also cause irqfd MSI injection and read guest ISR CSRs, which is Low privilege relative to the hypervisor, not init-namespace root.
UI:N - The attacker issues KVM ioctls or guest device I/O themselves; no separate victim action such as mounting a filesystem or opening a file is required.
S:C - dmsintc_inject_irq() writes host kernel stack contents into hardware guest ISR CSRs (LOONGARCH_CSR_ISR0-3) that the guest can read with csrrd and that the VMM can read after vcpu_put. That discloses hypervisor memory across the KVM guest-to-host boundary.
C:H - Up to four uninitialized unsigned long stack slots are OR'd into guest-visible ISR registers on every AVEC injection. Repeated MSI or KVM_RUN samples resample kernel stack including pointers, matching CNA stack-leak scoring for KASLR defeat.
I:L - The same uninitialized words are OR'd into guest ISR0-3, setting extra AVEC pending bits the VMM did not inject. That is limited corruption of guest interrupt-controller state, not an arbitrary host write or control-flow hijack.
A:N - The uninitialized values are consumed only as ISR bitmasks via gcsr_write; they are not used as pointers and do not oops, panic, hang, or otherwise deny host service.
CVSS 3.1