CVE-2024-36953: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-36953 affects the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem, specifically in the ARM64 architecture's Virtual GIC (Generic Interrupt Controller) v2 implementation. The vulnerability was discovered on May 30, 2024, and involves a NULL pointer dereference issue in the vgic_v2_parse_attr() function (NVD).

The vulnerability exists in the vgic_v2_parse_attr() function which is responsible for finding the vCPU that matches the user-provided CPUID. When an invalid ID is provided, kvm_get_vcpu_by_id() returns NULL, which wasn't properly handled by the code. The CVSS v3.1 base score is 4.4 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability could lead to a denial of service condition in the Linux kernel when processing virtual interrupt controller operations in KVM on ARM64 systems. The impact is limited to availability with no direct impact on confidentiality or integrity (CISA-ADP).

The vulnerability requires local access with high privileges to exploit. It can be triggered through invalid CPUID values passed to the vgic_v2_parse_attr() function in the KVM subsystem (Kernel Commit).

The vulnerability has been fixed by adding a NULL pointer check in the vgic_v2_parse_attr() function. The fix ensures that kvm_get_vcpu_by_id() returns a valid vCPU before proceeding, and returns -EINVAL if the vCPU is NULL. Users should update their Linux kernel to a version containing the fix (Kernel Commit).