CVE-2024-36953

What it actually does

Missing NULL check on kvm_get_vcpu_by_id() return value in vgic_v2_parse_attr() allows an invalid user-supplied CPUID to reach subsequent code paths, resulting in a NULL pointer dereference during KVM vGICv2 attribute ioctl handling.

Why it matters to the business

Local users on affected arm64 Linux systems can trigger kernel crashes or unexpected behavior in virtualized environments, leading to denial of service, potential privilege escalation, and disruption of workloads running on KVM.

How an attack unfolds

An attacker with local access invokes the KVM vGICv2 attribute ioctl with an invalid CPUID; the kernel fails to validate the vCPU pointer returned by kvm_get_vcpu_by_id() and proceeds to dereference it, causing a crash or exploitable condition.

How to fix it

Update the Linux kernel to a version containing commit 4404465a1bee3607ad90a4c5f9e16dfd75b85728 or later; rebuild and reboot all affected systems; verify the patch is present via git log or kernel version string.

How to confirm the fix worked

Confirm the fix by checking that vgic_v2_parse_attr() now validates the kvm_get_vcpu_by_id() result and returns an error for invalid CPUIDs; test with an invalid CPUID ioctl and verify graceful failure instead of dereference.

Typical attack path

1. Obtain local shell or process execution on the target arm64 Linux host
2. Open a KVM device file descriptor
3. Issue vGICv2 attribute ioctl supplying a non-existent CPUID
4. Trigger NULL dereference in vgic_v2_parse_attr()

How to detect it

Review kernel logs for NULL pointer dereference oops messages referencing vgic_v2_parse_attr or kvm_get_vcpu_by_id; inspect audit logs for unusual KVM ioctl calls from untrusted processes.

What your security team should do

• Prioritize kernel upgrades on all arm64 KVM hosts within standard change windows
• Monitor for local privilege-escalation attempts targeting KVM ioctls
• Restrict unprivileged access to /dev/kvm where operationally feasible