CVE-2024-26989

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-26989
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26989.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-26989
Downstream
Related
Published
2024-05-01T05:27:44Z
Modified
2025-10-15T11:27:19.983441Z
Summary
arm64: hibernate: Fix level3 translation fault in swsusp_save()
Details

In the Linux kernel, the following vulnerability has been resolved:

arm64: hibernate: Fix level3 translation fault in swsusp_save()

On arm64 machines, swsuspsave() faults if it attempts to access MEMBLOCKNOMAP memory ranges. This can be reproduced in QEMU using UEFI when booting with rodata=off debugpagealloc=off and CONFIGKFENCE=n:

Unable to handle kernel paging request at virtual address ffffff8000000000 Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 39-bit VAs, pgdp=00000000eeb0b000 [ffffff8000000000] pgd=180000217fff9803, p4d=180000217fff9803, pud=180000217fff9803, pmd=180000217fff8803, pte=0000000000000000 Internal error: Oops: 0000000096000007 [#1] SMP Internal error: Oops: 0000000096000007 [#1] SMP Modules linked in: xtmultiport iptREJECT nfrejectipv4 xtconntrack nfconntrack nfdefragipv6 nfdefragipv4 libcrc32c iptablefilter bpfilter rfkill at803x sndhdacodechdmi sndhdaintel sndinteldspcfg dwmacgeneric stmmacplatform sndhdacodec stmmac joydev pcsxpcs sndhdacore phylink ppdev lp parport ramoops reedsolomon iptables xtables nlsiso88591 vfat multipath linear amdgpu amdxcp drmexec gpusched drmbuddy hidgeneric usbhid hid radeon video drmsuballochelper drmttmhelper ttm i2calgobit drmdisplayhelper cec drmkmshelper drm CPU: 0 PID: 3663 Comm: systemd-sleep Not tainted 6.6.2+ #76 Source Version: 4e22ed63a0a48e7a7cff9b98b7806d8d4add7dc0 Hardware name: Greatwall GW-XXXXXX-XXX/GW-XXXXXX-XXX, BIOS KunLun BIOS V4.0 01/19/2021 pstate: 600003c5 (nZCv DAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : swsuspsave+0x280/0x538 lr : swsuspsave+0x280/0x538 sp : ffffffa034a3fa40 x29: ffffffa034a3fa40 x28: ffffff8000001000 x27: 0000000000000000 x26: ffffff8001400000 x25: ffffffc08113e248 x24: 0000000000000000 x23: 0000000000080000 x22: ffffffc08113e280 x21: 00000000000c69f2 x20: ffffff8000000000 x19: ffffffc081ae2500 x18: 0000000000000000 x17: 6666662074736420 x16: 3030303030303030 x15: 3038666666666666 x14: 0000000000000b69 x13: ffffff9f89088530 x12: 00000000ffffffea x11: 00000000ffff7fff x10: 00000000ffff7fff x9 : ffffffc08193f0d0 x8 : 00000000000bffe8 x7 : c0000000ffff7fff x6 : 0000000000000001 x5 : ffffffa0fff09dc8 x4 : 0000000000000000 x3 : 0000000000000027 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 000000000000004e Call trace: swsuspsave+0x280/0x538 swsusparchsuspend+0x148/0x190 hibernationsnapshot+0x240/0x39c hibernate+0xc4/0x378 statestore+0xf0/0x10c kobjattr_store+0x14/0x24

The reason is swsuspsave() -> copydatapages() -> pageissaveable() -> kernelpagepresent() assuming that a page is always present when cansetdirectmap() is false (all of rodatafull, debugpageallocenabled() and arm64kfencecansetdirectmap() false), irrespective of the MEMBLOCKNOMAP ranges. Such MEMBLOCKNOMAP regions should not be saved during hibernation.

This problem was introduced by changes to the pfnvalid() logic in commit a7d9f306ba70 ("arm64: drop pfnvalidwithin() and simplify pfnvalid()").

Similar to other architectures, drop the !cansetdirectmap() check in kernelpagepresent() so that pageis_savable() skips such pages.

[catalin.marinas@arm.com: rework commit message]

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
a7d9f306ba7052056edf9ccae596aeb400226af8
Fixed
813f5213f2c612dc800054859aaa396ec8ad7069
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
a7d9f306ba7052056edf9ccae596aeb400226af8
Fixed
f7e71a7cf399f53ff9fc314ca3836dc913b05bd6
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
a7d9f306ba7052056edf9ccae596aeb400226af8
Fixed
31f815cb436082e72d34ed2e8a182140a73ebdf4
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
a7d9f306ba7052056edf9ccae596aeb400226af8
Fixed
022b19ebc31cce369c407617041a3db810db23b3
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
a7d9f306ba7052056edf9ccae596aeb400226af8
Fixed
50449ca66cc5a8cbc64749cf4b9f3d3fc5f4b457

Affected versions

v5.*

v5.14
v5.14-rc1
v5.14-rc2
v5.14-rc3
v5.14-rc4
v5.14-rc5
v5.14-rc6
v5.14-rc7
v5.15
v5.15-rc1
v5.15-rc2
v5.15-rc3
v5.15-rc4
v5.15-rc5
v5.15-rc6
v5.15-rc7
v5.15.1
v5.15.10
v5.15.100
v5.15.101
v5.15.102
v5.15.103
v5.15.104
v5.15.105
v5.15.106
v5.15.107
v5.15.108
v5.15.109
v5.15.11
v5.15.110
v5.15.111
v5.15.112
v5.15.113
v5.15.114
v5.15.115
v5.15.116
v5.15.117
v5.15.118
v5.15.119
v5.15.12
v5.15.120
v5.15.121
v5.15.122
v5.15.123
v5.15.124
v5.15.125
v5.15.126
v5.15.127
v5.15.128
v5.15.129
v5.15.13
v5.15.130
v5.15.131
v5.15.132
v5.15.133
v5.15.134
v5.15.135
v5.15.136
v5.15.137
v5.15.138
v5.15.139
v5.15.14
v5.15.140
v5.15.141
v5.15.142
v5.15.143
v5.15.144
v5.15.145
v5.15.146
v5.15.147
v5.15.148
v5.15.149
v5.15.15
v5.15.150
v5.15.151
v5.15.152
v5.15.153
v5.15.154
v5.15.155
v5.15.156
v5.15.16
v5.15.17
v5.15.18
v5.15.19
v5.15.2
v5.15.20
v5.15.21
v5.15.22
v5.15.23
v5.15.24
v5.15.25
v5.15.26
v5.15.27
v5.15.28
v5.15.29
v5.15.3
v5.15.30
v5.15.31
v5.15.32
v5.15.33
v5.15.34
v5.15.35
v5.15.36
v5.15.37
v5.15.38
v5.15.39
v5.15.4
v5.15.40
v5.15.41
v5.15.42
v5.15.43
v5.15.44
v5.15.45
v5.15.46
v5.15.47
v5.15.48
v5.15.49
v5.15.5
v5.15.50
v5.15.51
v5.15.52
v5.15.53
v5.15.54
v5.15.55
v5.15.56
v5.15.57
v5.15.58
v5.15.59
v5.15.6
v5.15.60
v5.15.61
v5.15.62
v5.15.63
v5.15.64
v5.15.65
v5.15.66
v5.15.67
v5.15.68
v5.15.69
v5.15.7
v5.15.70
v5.15.71
v5.15.72
v5.15.73
v5.15.74
v5.15.75
v5.15.76
v5.15.77
v5.15.78
v5.15.79
v5.15.8
v5.15.80
v5.15.81
v5.15.82
v5.15.83
v5.15.84
v5.15.85
v5.15.86
v5.15.87
v5.15.88
v5.15.89
v5.15.9
v5.15.90
v5.15.91
v5.15.92
v5.15.93
v5.15.94
v5.15.95
v5.15.96
v5.15.97
v5.15.98
v5.15.99
v5.16
v5.16-rc1
v5.16-rc2
v5.16-rc3
v5.16-rc4
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.17
v5.17-rc1
v5.17-rc2
v5.17-rc3
v5.17-rc4
v5.17-rc5
v5.17-rc6
v5.17-rc7
v5.17-rc8
v5.18
v5.18-rc1
v5.18-rc2
v5.18-rc3
v5.18-rc4
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8

v6.*

v6.0
v6.0-rc1
v6.0-rc2
v6.0-rc3
v6.0-rc4
v6.0-rc5
v6.0-rc6
v6.0-rc7
v6.1
v6.1-rc1
v6.1-rc2
v6.1-rc3
v6.1-rc4
v6.1-rc5
v6.1-rc6
v6.1-rc7
v6.1-rc8
v6.1.1
v6.1.10
v6.1.11
v6.1.12
v6.1.13
v6.1.14
v6.1.15
v6.1.16
v6.1.17
v6.1.18
v6.1.19
v6.1.2
v6.1.20
v6.1.21
v6.1.22
v6.1.23
v6.1.24
v6.1.25
v6.1.26
v6.1.27
v6.1.28
v6.1.29
v6.1.3
v6.1.30
v6.1.31
v6.1.32
v6.1.33
v6.1.34
v6.1.35
v6.1.36
v6.1.37
v6.1.38
v6.1.39
v6.1.4
v6.1.40
v6.1.41
v6.1.42
v6.1.43
v6.1.44
v6.1.45
v6.1.46
v6.1.47
v6.1.48
v6.1.49
v6.1.5
v6.1.50
v6.1.51
v6.1.52
v6.1.53
v6.1.54
v6.1.55
v6.1.56
v6.1.57
v6.1.58
v6.1.59
v6.1.6
v6.1.60
v6.1.61
v6.1.62
v6.1.63
v6.1.64
v6.1.65
v6.1.66
v6.1.67
v6.1.68
v6.1.69
v6.1.7
v6.1.70
v6.1.71
v6.1.72
v6.1.73
v6.1.74
v6.1.75
v6.1.76
v6.1.77
v6.1.78
v6.1.79
v6.1.8
v6.1.80
v6.1.81
v6.1.82
v6.1.83
v6.1.84
v6.1.85
v6.1.86
v6.1.87
v6.1.9
v6.2
v6.2-rc1
v6.2-rc2
v6.2-rc3
v6.2-rc4
v6.2-rc5
v6.2-rc6
v6.2-rc7
v6.2-rc8
v6.3
v6.3-rc1
v6.3-rc2
v6.3-rc3
v6.3-rc4
v6.3-rc5
v6.3-rc6
v6.3-rc7
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.21
v6.6.22
v6.6.23
v6.6.24
v6.6.25
v6.6.26
v6.6.27
v6.6.28
v6.6.3
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.8.1
v6.8.2
v6.8.3
v6.8.4
v6.8.5
v6.8.6
v6.8.7
v6.9-rc1
v6.9-rc2
v6.9-rc3

Database specific

{
    "vanir_signatures": [
        {
            "signature_version": "v1",
            "signature_type": "Line",
            "target": {
                "file": "arch/arm64/mm/pageattr.c"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "5249007861076643319812900480462973001",
                    "338965220258321805046967597031269997633",
                    "220824228383571884645251930951875091671",
                    "292102582595918735169854039461766152563",
                    "332678702031344730298263327069821340678"
                ],
                "threshold": 0.9
            },
            "id": "CVE-2024-26989-0528c50e",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@31f815cb436082e72d34ed2e8a182140a73ebdf4"
        },
        {
            "signature_version": "v1",
            "signature_type": "Line",
            "target": {
                "file": "arch/arm64/mm/pageattr.c"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "5249007861076643319812900480462973001",
                    "338965220258321805046967597031269997633",
                    "220824228383571884645251930951875091671",
                    "292102582595918735169854039461766152563",
                    "332678702031344730298263327069821340678"
                ],
                "threshold": 0.9
            },
            "id": "CVE-2024-26989-08063a00",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50449ca66cc5a8cbc64749cf4b9f3d3fc5f4b457"
        },
        {
            "signature_version": "v1",
            "signature_type": "Function",
            "target": {
                "file": "arch/arm64/mm/pageattr.c",
                "function": "kernel_page_present"
            },
            "deprecated": false,
            "digest": {
                "length": 721.0,
                "function_hash": "284050137078142749750295183586950720453"
            },
            "id": "CVE-2024-26989-5ecdd31f",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@022b19ebc31cce369c407617041a3db810db23b3"
        },
        {
            "signature_version": "v1",
            "signature_type": "Line",
            "target": {
                "file": "arch/arm64/mm/pageattr.c"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "5249007861076643319812900480462973001",
                    "338965220258321805046967597031269997633",
                    "220824228383571884645251930951875091671",
                    "292102582595918735169854039461766152563",
                    "332678702031344730298263327069821340678"
                ],
                "threshold": 0.9
            },
            "id": "CVE-2024-26989-60f70aad",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@022b19ebc31cce369c407617041a3db810db23b3"
        },
        {
            "signature_version": "v1",
            "signature_type": "Function",
            "target": {
                "file": "arch/arm64/mm/pageattr.c",
                "function": "kernel_page_present"
            },
            "deprecated": false,
            "digest": {
                "length": 721.0,
                "function_hash": "284050137078142749750295183586950720453"
            },
            "id": "CVE-2024-26989-88eb8949",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@813f5213f2c612dc800054859aaa396ec8ad7069"
        },
        {
            "signature_version": "v1",
            "signature_type": "Line",
            "target": {
                "file": "arch/arm64/mm/pageattr.c"
            },
            "deprecated": false,
            "digest": {
                "line_hashes": [
                    "5249007861076643319812900480462973001",
                    "338965220258321805046967597031269997633",
                    "220824228383571884645251930951875091671",
                    "292102582595918735169854039461766152563",
                    "332678702031344730298263327069821340678"
                ],
                "threshold": 0.9
            },
            "id": "CVE-2024-26989-890a8abb",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@813f5213f2c612dc800054859aaa396ec8ad7069"
        },
        {
            "signature_version": "v1",
            "signature_type": "Function",
            "target": {
                "file": "arch/arm64/mm/pageattr.c",
                "function": "kernel_page_present"
            },
            "deprecated": false,
            "digest": {
                "length": 721.0,
                "function_hash": "284050137078142749750295183586950720453"
            },
            "id": "CVE-2024-26989-ccaaee4d",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@31f815cb436082e72d34ed2e8a182140a73ebdf4"
        },
        {
            "signature_version": "v1",
            "signature_type": "Function",
            "target": {
                "file": "arch/arm64/mm/pageattr.c",
                "function": "kernel_page_present"
            },
            "deprecated": false,
            "digest": {
                "length": 719.0,
                "function_hash": "261045696738913771225859168402276295506"
            },
            "id": "CVE-2024-26989-e5bed065",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50449ca66cc5a8cbc64749cf4b9f3d3fc5f4b457"
        }
    ]
}

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.14.0
Fixed
5.15.157
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.88
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.29
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.8.8