CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's KVM component, specifically the virtual Generic Interrupt Controller (vgic) for ARM64 architectures, allowing userspace to restore a Device Table Entry (DTE) with an out-of-range number of EventID bits. This flaw can lead to improper handling of interrupt mappings, potentially resulting in denial of service or arbitrary code execution due to unchecked memory access. Organizations utilizing Linux-based systems with KVM virtualization should prioritize patching this critical vulnerability to safeguard against potential exploitation.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that state, but vgic_its_restore_dte() accepts it and stores the out-of-range value in dev->num_eventid_bits. Reject restored DTEs with num_eventid_bits > VITS_TYPER_IDBITS before allocating the device. This mirrors the MAPD check and prevents the restored state from reaching vgic_its_restore_itt(), where the unchecked value can be converted into an oversized scan_its_table() range.
Related CVEs
Other vulnerabilities affecting the same vendor(s)