CVE-2024-50114

Summary

CVE-2024-50114: A vulnerability was discovered in the Linux kernel's KVM module for arm64 architectures. A use-after-free issue was identified when tearing down a Virtual Machine (VM), resulting in a memory leak. The root cause was a failure to properly unregister MMIO registrations for vCPUs that fail creation, especially when a vCPU with the same ID already exists in the VM. The initial commit intended to prevent a lock inversion issue by breaking down the vCPU teardown into two parts, but it inadvertently moved the unregistration out of the correct location. To mitigate this, a special-cased unregistration was added to the correct location in __kvm_vgic_vcpu_destroy() to safely handle failed vCPUs without incurring a lock inversion.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.