In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
MAPC with V=0 drops ite->collection but leaves the ITE on the device's
ITT list, and vgic_its_save_ite() dereferences it unconditionally. A
guest that issues MAPD, MAPTI and then MAPC(V=0) therefore oopses the
host when the VMM issues KVM_DEV_ARM_ITS_SAVE_TABLES to migrate it.
That sequence is UNPREDICTABLE per the architecture, but KVM already
handles the resulting state in the translate, MOVI and DISCARD paths.
Save a zeroed entry, which vgic_its_restore_ite() reads back as
invalid. Skipping the ITE instead would leave the ITT slot holding
whatever is in guest memory, and restore rejects an entry naming a
collection the restored collection table does not have.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS Score: 7.1
AV:L - The NULL dereference is reached only via the local KVM ioctl KVM_SET_DEVICE_ATTR(KVM_DEV_ARM_ITS_SAVE_TABLES) after the guest programs in-kernel GICv3 ITS MMIO (MAPD/MAPTI/MAPC or GITS_BASER); it is not triggered by network packets, adjacent-radio frames, or a physical device.
AC:L - A guest can deterministically issue MAPD, MAPTI, then MAPC with V=0, or clear GITS_BASER collection Valid, leaving ITEs on the ITT with a NULL collection; SAVE_TABLES then always dereferences it with no race or attacker-uncontrollable host layout.
PR:N - The highest-impact case is a cloud VM tenant who needs no host privileges: they program the ITS from guest EL1 and the host oopses when the hypervisor saves ITS tables during automated live migration, without host root, capabilities, or tenant access to /dev/kvm.
UI:N - No extra victim action is required beyond normal hypervisor operations such as automated live migration or snapshot save that invoke SAVE_TABLES; a local VMM can also issue that ioctl itself.
S:C - The fault runs in host KVM while saving guest-controlled ITS state, so a host oops/panic takes down the hypervisor and co-resident VMs, crossing the KVM guest-to-host security boundary.
C:N - vgic_its_save_ite() only loads collection_id through a NULL ite->collection pointer; this is a pure NULL dereference with no out-of-bounds read, use-after-free, or other host disclosure primitive.
I:N - The NULL collection is read and not written, and the bug does not corrupt host kernel memory, provide an arbitrary write, or hijack host control flow beyond the faulting load.
A:H - Dereferencing the NULL collection in vgic_its_save_ite() oopses or panics the host kernel during ITS table save, denying service to the hypervisor and every co-located VM.
| Attack Vector |
Local |
Scope |
Changed |
| Attack Complexity |
Low |
Confidentiality Impact |
None |
| Privileges Required |
None |
Integrity Impact |
None |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The NULL dereference is reached only via the local KVM ioctl KVM_SET_DEVICE_ATTR(KVM_DEV_ARM_ITS_SAVE_TABLES) after the guest programs in-kernel GICv3 ITS MMIO (MAPD/MAPTI/MAPC or GITS_BASER); it is not triggered by network packets, adjacent-radio frames, or a physical device.
AC:L - A guest can deterministically issue MAPD, MAPTI, then MAPC with V=0, or clear GITS_BASER collection Valid, leaving ITEs on the ITT with a NULL collection; SAVE_TABLES then always dereferences it with no race or attacker-uncontrollable host layout.
PR:N - The highest-impact case is a cloud VM tenant who needs no host privileges: they program the ITS from guest EL1 and the host oopses when the hypervisor saves ITS tables during automated live migration, without host root, capabilities, or tenant access to /dev/kvm.
UI:N - No extra victim action is required beyond normal hypervisor operations such as automated live migration or snapshot save that invoke SAVE_TABLES; a local VMM can also issue that ioctl itself.
S:C - The fault runs in host KVM while saving guest-controlled ITS state, so a host oops/panic takes down the hypervisor and co-resident VMs, crossing the KVM guest-to-host security boundary.
C:N - vgic_its_save_ite() only loads collection_id through a NULL ite->collection pointer; this is a pure NULL dereference with no out-of-bounds read, use-after-free, or other host disclosure primitive.
I:N - The NULL collection is read and not written, and the bug does not corrupt host kernel memory, provide an arbitrary write, or hijack host control flow beyond the faulting load.
A:H - Dereferencing the NULL collection in vgic_its_save_ite() oopses or panics the host kernel during ITS table save, denying service to the hypervisor and every co-located VM.
CVSS 3.1