172 lines
9.9 KiB
JSON
172 lines
9.9 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2024-42293",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2024-07-30T07:40:12.268Z",
|
|
"datePublished": "2024-08-17T09:09:02.303Z",
|
|
"dateUpdated": "2026-08-05T11:36:25.572Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T11:36:25.572Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: mm: Fix lockless walks with static and dynamic page-table folding\n\nLina reports random oopsen originating from the fast GUP code when\n16K pages are used with 4-level page-tables, the fourth level being\nfolded at runtime due to lack of LPA2.\n\nIn this configuration, the generic implementation of\np4d_offset_lockless() will return a 'p4d_t *' corresponding to the\n'pgd_t' allocated on the stack of the caller, gup_fast_pgd_range().\nThis is normally fine, but when the fourth level of page-table is folded\nat runtime, pud_offset_lockless() will offset from the address of the\n'p4d_t' to calculate the address of the PUD in the same page-table page.\nThis results in a stray stack read when the 'p4d_t' has been allocated\non the stack and can send the walker into the weeds.\n\nFix the problem by providing our own definition of p4d_offset_lockless()\nwhen CONFIG_PGTABLE_LEVELS <= 4 which returns the real page-table\npointer rather than the address of the local stack variable."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable code is reached via ordinary syscalls that invoke GUP-fast on `current->mm` (O_DIRECT read/write, io_uring, vmsplice, futex, process_vm_readv), and it walks the calling task's own kernel stack. This requires local code execution; there is no remote or adjacent trigger.\nAC:L - No race and no unpredictable state is needed — the stray stack read happens on every GUP-fast call in the affected configuration, and the attacker directly selects which 8-byte stack word is used as a PUD by choosing the user address (`pud_index(addr) = (addr >> 36) & 2047` covers the whole 16K stack). The vulnerable build (16K pages with the default 52-bit VA) plus non-LPA2 hardware is a real, widely shipped deployment (Asahi Linux, 16KB-page Android), and is not a condition the attacker must win.\nPR:L - Any unprivileged local user can call `pread()`/`pwrite()` on an O_DIRECT fd, `vmsplice()`, `futex()`, or io_uring to enter `gup_fast_fallback()`. No capability, namespace, or other access check exists on the path.\nUI:N - The attacker triggers the fault entirely through their own syscalls on their own address space; no victim action or cooperation is needed.\nS:U - The corruption and its consequences are confined to the kernel's own security authority — standard kernel memory corruption and privilege escalation, not a VM or IOMMU boundary crossing.\nC:H - Attacker-controlled kernel-stack words (including `pt_regs`-held user register values) are interpreted as PUD/PMD/PTE entries with no `pfn_valid()` check in production builds, so `pud_page()`/`pte_page()` returns a struct page for an arbitrary PFN that the caller then reads — an arbitrary physical memory read primitive (e.g. dumping kernel memory via an O_DIRECT write).\nI:H - The same fabricated page-table walk lets an O_DIRECT read or io_uring write target arbitrary physical pages, and `try_grab_folio()` performs a refcount increment on a struct page synthesized from a fully controlled 64-bit value, giving arbitrary write primitives suitable for control-flow hijacking and privilege escalation.\nA:H - The reporter observed random kernel oopsen from the fast GUP code in this configuration, and dereferencing garbage as page-table entries reliably produces kernel panics and refcount corruption."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"arch/arm64/include/asm/pgtable.h"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "0dd4f60a2c76938c2625f6c630c225699d97608b",
|
|
"lessThan": "78672d49d3eebbcda3589f4d6e589caf357c5a59",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "0dd4f60a2c76938c2625f6c630c225699d97608b",
|
|
"lessThan": "36639013b3462c06ff8e3400a427f775b4fc97f5",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"arch/arm64/include/asm/pgtable.h"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.9",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.9",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.10.3",
|
|
"lessThanOrEqual": "6.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.11",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.9",
|
|
"versionEndExcluding": "6.10.3"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.9",
|
|
"versionEndExcluding": "6.11"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/78672d49d3eebbcda3589f4d6e589caf357c5a59"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/36639013b3462c06ff8e3400a427f775b4fc97f5"
|
|
}
|
|
],
|
|
"title": "arm64: mm: Fix lockless walks with static and dynamic page-table folding",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2024-42293",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2024-09-10T16:10:57.009784Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2024-09-12T17:33:29.368Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |