ghsa-p4c2-xvqp-v8qj
Vulnerability from github
Published
2025-02-27 03:34
Modified
2025-03-06 12:30
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Details

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking

When waking a VM's NX huge page recovery thread, ensure the thread is actually alive before trying to wake it. Now that the thread is spawned on-demand during KVM_RUN, a VM without a recovery thread is reachable via the related module params.

BUG: kernel NULL pointer dereference, address: 0000000000000040 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:vhost_task_wake+0x5/0x10 Call Trace: set_nx_huge_pages+0xcc/0x1e0 [kvm] param_attr_store+0x8a/0xd0 module_attr_store+0x1a/0x30 kernfs_fop_write_iter+0x12f/0x1e0 vfs_write+0x233/0x3e0 ksys_write+0x60/0xd0 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f3b52710104 Modules linked in: kvm_intel kvm CR2: 0000000000000040

Show details on source website

To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-21740"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-27T03:15:14Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Ensure NX huge page recovery thread is alive before waking\n\nWhen waking a VM\u0027s NX huge page recovery thread, ensure the thread is\nactually alive before trying to wake it.  Now that the thread is spawned\non-demand during KVM_RUN, a VM without a recovery thread is reachable via\nthe related module params.\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000040\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n  RIP: 0010:vhost_task_wake+0x5/0x10\n  Call Trace:\n   \u003cTASK\u003e\n   set_nx_huge_pages+0xcc/0x1e0 [kvm]\n   param_attr_store+0x8a/0xd0\n   module_attr_store+0x1a/0x30\n   kernfs_fop_write_iter+0x12f/0x1e0\n   vfs_write+0x233/0x3e0\n   ksys_write+0x60/0xd0\n   do_syscall_64+0x5b/0x160\n   entry_SYSCALL_64_after_hwframe+0x4b/0x53\n  RIP: 0033:0x7f3b52710104\n   \u003c/TASK\u003e\n  Modules linked in: kvm_intel kvm\n  CR2: 0000000000000040",
  "id": "GHSA-p4c2-xvqp-v8qj",
  "modified": "2025-03-06T12:30:41Z",
  "published": "2025-02-27T03:34:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21740"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2b3928b7c896e5a9fb6b1373924adafe8e01a0c6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/43fb96ae78551d7bfa4ecca956b258f085d67c40"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/974f85f1f7eb7dc7fce0988046e06eeccab576a7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.