{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-35980", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.144Z", "datePublished": "2024-05-20T09:42:05.085Z", "dateUpdated": "2026-08-05T11:31:22.855Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:31:22.855Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: tlb: Fix TLBI RANGE operand\n\nKVM/arm64 relies on TLBI RANGE feature to flush TLBs when the dirty\npages are collected by VMM and the page table entries become write\nprotected during live migration. Unfortunately, the operand passed\nto the TLBI RANGE instruction isn't correctly sorted out due to the\ncommit 117940aa6e5f (\"KVM: arm64: Define kvm_tlb_flush_vmid_range()\").\nIt leads to crash on the destination VM after live migration because\nTLBs aren't flushed completely and some of the dirty pages are missed.\n\nFor example, I have a VM where 8GB memory is assigned, starting from\n0x40000000 (1GB). Note that the host has 4KB as the base page size.\nIn the middile of migration, kvm_tlb_flush_vmid_range() is executed\nto flush TLBs. It passes MAX_TLBI_RANGE_PAGES as the argument to\n__kvm_tlb_flush_vmid_range() and __flush_s2_tlb_range_op(). SCALE#3\nand NUM#31, corresponding to MAX_TLBI_RANGE_PAGES, isn't supported\nby __TLBI_RANGE_NUM(). In this specific case, -1 has been returned\nfrom __TLBI_RANGE_NUM() for SCALE#3/2/1/0 and rejected by the loop\nin the __flush_tlb_range_op() until the variable @scale underflows\nand becomes -9, 0xffff708000040000 is set as the operand. The operand\nis wrong since it's sorted out by __TLBI_VADDR_RANGE() according to\ninvalid @scale and @num.\n\nFix it by extending __TLBI_RANGE_NUM() to support the combination of\nSCALE#3 and NUM#31. With the changes, [-1 31] instead of [-1 30] can\nbe returned from the macro, meaning the TLBs for 0x200000 pages in the\nabove example can be flushed in one shoot with SCALE#3 and NUM#31. The\nmacro TLBI_RANGE_MASK is dropped since no one uses it any more. The\ncomments are also adjusted accordingly." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The defect is triggered from the host via /dev/kvm — creating a VM with a ≥8GB memslot and enabling dirty logging (KVM_MEM_LOG_DIRTY_PAGES / KVM_GET_DIRTY_LOG), i.e. local ioctl access. There is no network-facing path to `kvm_tlb_flush_vmid_range()`.\nAC:L - Every precondition is attacker-selectable — memslot size and dirty-logging enablement are chosen by the VMM, and the trigger is deterministic once `nr_pages >= MAX_TLBI_RANGE_PAGES`; there is no race or unpredictable memory layout involved. FEAT_TLBIRANGE is present on all modern ARMv8.4+ server parts that host the large migratable VMs this affects, so it is a deployment property rather than a condition outside the attacker's control.\nPR:L - An ordinary local user with access to /dev/kvm (world- or kvm-group-accessible on typical distros, and the normal privilege level of QEMU/crosvm VMM processes) can create the large memslot and enable dirty logging. No root or CAP_SYS_ADMIN in the init namespace is needed.\nUI:N - The attacker performs the full sequence themselves — allocate the memslot, set KVM_MEM_LOG_DIRTY_PAGES, and issue the dirty-log ioctls — so no separate victim action is required to reach the broken TLBI operand.\nS:C - The failure is in the host kernel's stage-2 TLB maintenance, but the consequence lands in a different security authority: the guest VM silently bypasses a hypervisor-imposed write protection and the VMM's migration/dirty-tracking state is falsified. A hypervisor failing to enforce stage-2 memory protection crosses the VM isolation boundary.\nC:N - The affected path (`kvm_arch_flush_remote_tlbs_range()` after stage-2 write-protect) changes only permissions, never the physical address behind an IPA, so the stale TLB entries still point at the guest's own pages. The unmap path — the one that could have exposed freed host memory — uses the non-range `__kvm_tlb_flush_vmid_ipa` and is unaffected, so no cross-boundary read primitive exists.\nI:H - Roughly 15/16ths of each 8GB flush range is never invalidated, so guest writes to write-protected pages go undetected and unrecorded in the dirty bitmap, silently corrupting the migrated/snapshotted VM memory image with attacker-influenceable stale content. A hypervisor-established memory protection is not enforced, which is an integrity failure at the virtualization boundary.\nA:H - The commit documents the direct observed result — the destination VM crashes after live migration because dirty pages were missed and its memory is inconsistent. That is a full denial of service for the affected guest, reproducible on every migration of a sufficiently large VM." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/arm64/include/asm/tlbflush.h" ], "versions": [ { "version": "117940aa6e5f8308f1529e1313660980f1dae771", "lessThan": "ac4ad513de4fba18b4ac0ace132777d0910e8cfa", "status": "affected", "versionType": "git" }, { "version": "117940aa6e5f8308f1529e1313660980f1dae771", "lessThan": "944db7b536baaf49d7e576af36a94f4719552b07", "status": "affected", "versionType": "git" }, { "version": "117940aa6e5f8308f1529e1313660980f1dae771", "lessThan": "e3ba51ab24fddef79fc212f9840de54db8fd1685", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/arm64/include/asm/tlbflush.h" ], "versions": [ { "version": "6.6", "status": "affected" }, { "version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.29", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.7", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.29" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.8.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.9" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ac4ad513de4fba18b4ac0ace132777d0910e8cfa" }, { "url": "https://git.kernel.org/stable/c/944db7b536baaf49d7e576af36a94f4719552b07" }, { "url": "https://git.kernel.org/stable/c/e3ba51ab24fddef79fc212f9840de54db8fd1685" } ], "title": "arm64: tlb: Fix TLBI RANGE operand", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-35980", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-05-20T17:01:18.086941Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:34:21.474Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:49.188Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/ac4ad513de4fba18b4ac0ace132777d0910e8cfa", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/944db7b536baaf49d7e576af36a94f4719552b07", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/e3ba51ab24fddef79fc212f9840de54db8fd1685", "tags": [ "x_transferred" ] } ] } ] } }