Linux Kernel Hyper-V Utility Driver NULL Pointer Dereference Vulnerability

A vulnerability in the Linux kernel's Hyper-V utility driver can lead to a NULL pointer dereference, causing a kernel panic. This issue occurs if the KVP (Key-Value Pair) or VSS (Volume Shadow Copy Service) daemon starts before the VMBus channel's ringbuffer is fully initialized. The problem arises because the KVP/VSS channel callback can be invoked prematurely, leading to the panic. The vulnerability affects Linux kernel versions through 6.11.0-rc3.

Impact

Exploitation of this vulnerability causes a kernel panic due to a NULL pointer dereference.

Reproduction

To reproduce this vulnerability, unload and reload the 'hv_utils' driver, then manually start the KVP daemon within 10 seconds. This timing takes advantage of the race condition where the daemon registers with the driver before the VMBus channel is fully opened, causing the callback to dereference a NULL pointer.

Remediation

The vulnerability has been addressed by reordering the initialization steps in the Hyper-V utility driver, ensuring that the VMBus channel is fully opened before the KVP or VSS daemon can register with the driver.