CVE-2024-46864

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/hyperv: fix kexec crash due to VP assist page corruption

commit 9636be85cc5b ("x86/hyperv: Fix hyperv_pcpu_input_arg handling when

CPUs go online/offline") introduces a new cpuhp state for hyperv

initialization.

cpuhp_setup_state() returns the state number if state is

CPUHP_AP_ONLINE_DYN or CPUHP_BP_PREPARE_DYN and 0 for all other states.

For the hyperv case, since a new cpuhp state was introduced it would

return 0. However, in hv_machine_shutdown(), the cpuhp_remove_state() call

is conditioned upon "hyperv_init_cpuhp > 0". This will never be true and

so hv_cpu_die() won't be called on all CPUs. This means the VP assist page

won't be reset. When the kexec kernel tries to setup the VP assist page

again, the hypervisor corrupts the memory region of the old VP assist page

causing a panic in case the kexec kernel is using that memory elsewhere.

This was originally fixed in commit dfe94d4086e4 ("x86/hyperv: Fix kexec

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References