Bug 1222625 (CVE-2024-27437)

Summary:	VUL-0: CVE-2024-27437: kernel: vfio/pci: Disable auto-enable of exclusive INTx IRQ
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Karasulli <vasant.karasulli>
Status:	NEW ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	gianluca.gabrielli, mbrugger, mhocko, vasant.karasulli
Version:	unspecified	Flags:	mhocko: needinfo? (mbrugger)
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/400469/
Whiteboard:	CVSSv3.1:SUSE:CVE-2024-27437:4.4:(AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-04-10 12:32:53 UTC

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Disable auto-enable of exclusive INTx IRQ

Currently for devices requiring masking at the irqchip for INTx, ie.
devices without DisINTx support, the IRQ is enabled in request_irq()
and subsequently disabled as necessary to align with the masked status
flag.  This presents a window where the interrupt could fire between
these events, resulting in the IRQ incrementing the disable depth twice.
This would be unrecoverable for a user since the masked flag prevents
nested enables through vfio.

Instead, invert the logic using IRQF_NO_AUTOEN such that exclusive INTx
is never auto-enabled, then unmask as required.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-27437
https://www.cve.org/CVERecord?id=CVE-2024-27437
https://git.kernel.org/stable/c/139dfcc4d723ab13469881200c7d80f49d776060
https://git.kernel.org/stable/c/2a4a666c45107206605b7b5bc20545f8aabc4fa2
https://git.kernel.org/stable/c/3b3491ad0f80d913e7d255941d4470f4a4d9bfda
https://git.kernel.org/stable/c/bf0bc84a20e6109ab07d5dc072067bd01eb931ec
https://git.kernel.org/stable/c/fe9a7082684eb059b925c535682e68c34d487d43
https://bugzilla.redhat.com/show_bug.cgi?id=2273657
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-27437.mbox