CVE-2024-35801

MEDIUM

Linux Kernel < 6.1.84 - Use After Free

Title source: rule

Description

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD Commit 672365477ae8 ("x86/fpu: Update XFD state where required") and commit 8bf26758ca96 ("x86/fpu: Add XFD state to fpstate") introduced a per CPU variable xfd_state to keep the MSR_IA32_XFD value cached, in order to avoid unnecessary writes to the MSR. On CPU hotplug MSR_IA32_XFD is reset to the init_fpstate.xfd, which wipes out any stale state. But the per CPU cached xfd value is not reset, which brings them out of sync. As a consequence a subsequent xfd_update_state() might fail to update the MSR which in turn can result in XRSTOR raising a #NM in kernel space, which crashes the kernel. To fix this, introduce xfd_set_state() to write xfd_state together with MSR_IA32_XFD, and use it in all places that set MSR_IA32_XFD.

Scores

CVSS v3 5.5
EPSS 0.0002
EPSS Percentile 3.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Classification

CWE
CWE-416
Status published

Affected Products (5)

linux/linux_kernel < 6.1.84
linux/Kernel < 6.1.84linux
linux/Kernel < 6.6.24linux
linux/Kernel < 6.7.12linux
linux/Kernel < 6.8.3linux

Timeline

Published May 17, 2024
Tracked Since Feb 18, 2026