CVE-2024-46707

What it actually does

NULL pointer dereference in KVM arm64 SGI emulation when guest lacks vGICv3 and host lacks GICv2 emulation, because no private interrupt is allocated before register access is trapped to EL2.

Why it matters to the business

Guest-triggered host kernel crashes on arm64 KVM systems can cause denial of service and unplanned downtime; the flaw affects widely deployed Linux kernels though exploitation requires specific misconfiguration.

How an attack unfolds

An attacker with guest access writes to ICC_*SGI*_EL1 registers; the access traps to EL2, KVM attempts SGI emulation without a vGICv3, and dereferences a NULL pointer, crashing the host.

How to fix it

Upgrade the Linux kernel to commit 15818af2f7aa55eff375333cb7689df15d3f24ef or a later stable branch containing the fix; rebuild and reboot affected hosts.

How to confirm the fix worked

Confirm the running kernel contains commit 15818af2f7aa55eff375333cb7689df15d3f24ef; launch a test guest without vGICv3 and verify writes to ICC_*SGI*_EL1 now produce an UNDEF exception instead of a host crash.

Typical attack path

1. Obtain code execution or shell in a KVM guest lacking vGICv3
2. Issue store to ICC_SGI1R_EL1 or related registers
3. Trigger host KVM trap handler that hits NULL gic pointer
4. Cause kernel oops or panic

How to detect it

Search kernel logs and dmesg for NULL pointer dereference messages originating from kvm_vgic or arm64 SGI emulation routines around the time of guest activity.

• kvm_vgic: NULL pointer
• ICC_SGI1R_EL1 emulation
• no private interrupt allocated

What your security team should do

• Apply the referenced kernel commit on all arm64 KVM hosts within the next maintenance window
• Audit guest configurations to ensure vGICv3 is enabled where supported
• Add kernel oops monitoring for KVM arm64 paths to detect attempted exploitation