In the Linux kernel, the following vulnerability has been resolved:
ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
Since commit a4d5613c4dc6 ("arm: extend pfnvalid to take into account freed memory map alignment") changes the semantics of pfnvalid() to check presence of the memory map for a PFN. A valid page for an address which is reserved but not mapped by the kernel[1], the system crashed during some uio test with the following memory layout:
node 0: [mem 0x00000000c0a00000-0x00000000cc8fffff] node 0: [mem 0x00000000d0000000-0x00000000da1fffff] the uio layout is:0xc0900000, 0x100000
the crash backtrace like:
Unable to handle kernel paging request at virtual address bff00000 [...] CPU: 1 PID: 465 Comm: startapp.bin Tainted: G O 5.10.0 #1 Hardware name: Generic DT based system PC is at b15flushkerndcachearea+0x24/0x3c LR is at syncicachedcache+0x6c/0x98 [...] (b15flushkerndcachearea) from (syncicachedcache+0x6c/0x98) (syncicachedcache) from (setpteat+0x28/0x54) (setpteat) from (remappfnrange+0x1a0/0x274) (remappfnrange) from (uiommap+0x184/0x1b8 [uio]) (uiommap [uio]) from (mmapregion+0x264/0x5f4) (mmapregion) from (dommapmm+0x3ec/0x440) (_dommapmm) from (dommap+0x50/0x58) (dommap) from (vmmmappgoff+0xfc/0x188) (vmmmappgoff) from (ksysmmappgoff+0xac/0xc4) (ksysmmappgoff) from (retfast_syscall+0x0/0x5c) Code: e0801001 e2423001 e1c00003 f57ff04f (ee070f3e) ---[ end trace 09cf0734c3805d52 ]--- Kernel panic - not syncing: Fatal exception
So check if PG_reserved was set to solve this issue.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 420.0,
"function_hash": "227149445324472895029804303465005335610"
},
"id": "CVE-2024-26947-17df6e95",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb3a122a978626b33de3367ee1762da934c0f512",
"target": {
"file": "arch/arm/mm/flush.c",
"function": "__sync_icache_dcache"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 420.0,
"function_hash": "227149445324472895029804303465005335610"
},
"id": "CVE-2024-26947-58d691ef",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f7ddc222cae8254e93d5c169a8ae11a49d912a7",
"target": {
"file": "arch/arm/mm/flush.c",
"function": "__sync_icache_dcache"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 420.0,
"function_hash": "227149445324472895029804303465005335610"
},
"id": "CVE-2024-26947-661af35f",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c027c2bad7f5111c51a358b5d392e1a695dabff",
"target": {
"file": "arch/arm/mm/flush.c",
"function": "__sync_icache_dcache"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 420.0,
"function_hash": "227149445324472895029804303465005335610"
},
"id": "CVE-2024-26947-7fcef348",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c66c6f4e21cb22220cbd8821c5c73fc157d20dc",
"target": {
"file": "arch/arm/mm/flush.c",
"function": "__sync_icache_dcache"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"287755329093729321573135615502591944693",
"209974611600670937705473563604781469429",
"263937360378354069877947944724703970044",
"265576061550094191744130652896275008180"
]
},
"id": "CVE-2024-26947-8e34b2e6",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb3a122a978626b33de3367ee1762da934c0f512",
"target": {
"file": "arch/arm/mm/flush.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"287755329093729321573135615502591944693",
"209974611600670937705473563604781469429",
"263937360378354069877947944724703970044",
"265576061550094191744130652896275008180"
]
},
"id": "CVE-2024-26947-abf8ab03",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c027c2bad7f5111c51a358b5d392e1a695dabff",
"target": {
"file": "arch/arm/mm/flush.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"287755329093729321573135615502591944693",
"209974611600670937705473563604781469429",
"263937360378354069877947944724703970044",
"265576061550094191744130652896275008180"
]
},
"id": "CVE-2024-26947-b1920758",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c66c6f4e21cb22220cbd8821c5c73fc157d20dc",
"target": {
"file": "arch/arm/mm/flush.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"287755329093729321573135615502591944693",
"209974611600670937705473563604781469429",
"263937360378354069877947944724703970044",
"265576061550094191744130652896275008180"
]
},
"id": "CVE-2024-26947-d4ffd329",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f7ddc222cae8254e93d5c169a8ae11a49d912a7",
"target": {
"file": "arch/arm/mm/flush.c"
}
}
]