CVE-2024-49886
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-49886
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-49886.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-49886
- Downstream
- Related
- Published
- 2024-10-21T18:01:22.870Z
- Modified
- 2025-11-20T07:06:41.347036Z
- Summary
- platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
Attaching SST PCI device to VM causes "BUG: KASAN: slab-out-of-bounds". kasan report: [ 19.411889] ================================================================== [ 19.413702] BUG: KASAN: slab-out-of-bounds in isstifgetpcidev+0x3d5/0x400 [isstifcommon] [ 19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113 [ 19.417368] [ 19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G E 6.9.0 #10 [ 19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022 [ 19.422687] Call Trace: [ 19.424091] <TASK> [ 19.425448] dumpstacklvl+0x5d/0x80 [ 19.426963] ? _isstifgetpcidev+0x3d5/0x400 [isstifcommon] [ 19.428694] printreport+0x19d/0x52e [ 19.430206] ? pfxrawspinlockirqsave+0x10/0x10 [ 19.431837] ? _isstifgetpcidev+0x3d5/0x400 [isstifcommon] [ 19.433539] kasanreport+0xf0/0x170 [ 19.435019] ? isstifgetpcidev+0x3d5/0x400 [isstifcommon] [ 19.436709] _isstifgetpcidev+0x3d5/0x400 [isstifcommon] [ 19.438379] ? _pfxschedclockcpu+0x10/0x10 [ 19.439910] isstifcpuonline+0x406/0x58f [isstifcommon] [ 19.441573] ? _pfxisstifcpuonline+0x10/0x10 [isstifcommon] [ 19.443263] ? ttwuqueuewakelist+0x2c1/0x360 [ 19.444797] cpuhpinvokecallback+0x221/0xec0 [ 19.446337] cpuhpthreadfun+0x21b/0x610 [ 19.447814] ? _pfxcpuhpthreadfun+0x10/0x10 [ 19.449354] smpbootthreadfn+0x2e7/0x6e0 [ 19.450859] ? _pfxsmpbootthreadfn+0x10/0x10 [ 19.452405] kthread+0x29c/0x350 [ 19.453817] ? _pfxkthread+0x10/0x10 [ 19.455253] retfromfork+0x31/0x70 [ 19.456685] ? _pfxkthread+0x10/0x10 [ 19.458114] retfromforkasm+0x1a/0x30 [ 19.459573] </TASK> [ 19.460853] [ 19.462055] Allocated by task 1198: [ 19.463410] kasansavestack+0x30/0x50 [ 19.464788] kasansavetrack+0x14/0x30 [ 19.466139] _kasankmalloc+0xaa/0xb0 [ 19.467465] _kmalloc+0x1cd/0x470 [ 19.468748] isstifcdevregister+0x1da/0x350 [isstifcommon] [ 19.470233] isstifmboxinit+0x108/0xff0 [isstifmboxmsr] [ 19.471670] dooneinitcall+0xa4/0x380 [ 19.472903] doinitmodule+0x238/0x760 [ 19.474105] loadmodule+0x5239/0x6f00 [ 19.475285] initmodulefromfile+0xd1/0x130 [ 19.476506] idempotentinitmodule+0x23b/0x650 [ 19.477725] _x64sysfinitmodule+0xbe/0x130 [ 19.476506] idempotentinitmodule+0x23b/0x650 [ 19.477725] _x64sysfinitmodule+0xbe/0x130 [ 19.478920] dosyscall64+0x82/0x160 [ 19.480036] entrySYSCALL64afterhwframe+0x76/0x7e [ 19.481292] [ 19.482205] The buggy address belongs to the object at ffff888829e65000 which belongs to the cache kmalloc-512 of size 512 [ 19.484818] The buggy address is located 0 bytes to the right of allocated 512-byte region [ffff888829e65000, ffff888829e65200) [ 19.487447] [ 19.488328] The buggy address belongs to the physical page: [ 19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60 [ 19.491140] head: order:3 entiremapcount:0 nrpagesmapped:0 pincount:0 [ 19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff) [ 19.493914] pagetype: 0xffffffff() [ 19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001 [ 19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000 [ 19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001 [ 19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000 [ 19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff [ 19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000 [ 19.503784] page dumped because: k ---truncated---
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/1973c4d8ee0782a808303d75e3be9c12baaacd97
- https://git.kernel.org/stable/c/7d59ac07ccb58f8f604f8057db63b8efcebeb3de
- https://git.kernel.org/stable/c/8176d4878ed2af5d93ddd0e971e24c412124d38b
- https://git.kernel.org/stable/c/afa7f78d9a907cfded6c98c91aae2bf7b3b56e51
- https://git.kernel.org/stable/c/cdd03afcb6eda3103da5a0948d3db12372f62910
- https://git.kernel.org/stable/c/cebc705b097d5c16469b141a25e840161d1c517a
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced017a634f9f38ae704d9d57817555773de700219eFixed1973c4d8ee0782a808303d75e3be9c12baaacd97
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9a1aac8a96dc014bec49806a7a964bf2fdbd315fFixedcdd03afcb6eda3103da5a0948d3db12372f62910
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9a1aac8a96dc014bec49806a7a964bf2fdbd315fFixed8176d4878ed2af5d93ddd0e971e24c412124d38b
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9a1aac8a96dc014bec49806a7a964bf2fdbd315fFixedcebc705b097d5c16469b141a25e840161d1c517a
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9a1aac8a96dc014bec49806a7a964bf2fdbd315fFixedafa7f78d9a907cfded6c98c91aae2bf7b3b56e51
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9a1aac8a96dc014bec49806a7a964bf2fdbd315fFixed7d59ac07ccb58f8f604f8057db63b8efcebeb3de
Affected versions
v5.*
v6.*
Database specific
vanir_signatures
[
{
"id": "CVE-2024-49886-2e252d9d",
"signature_version": "v1",
"digest": {
"length": 993.0,
"function_hash": "15234586025030545842501140530383430669"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cebc705b097d5c16469b141a25e840161d1c517a",
"target": {
"file": "drivers/platform/x86/intel/speed_select_if/isst_if_common.c",
"function": "_isst_if_get_pci_dev"
}
},
{
"id": "CVE-2024-49886-313902e1",
"signature_version": "v1",
"digest": {
"length": 993.0,
"function_hash": "15234586025030545842501140530383430669"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d59ac07ccb58f8f604f8057db63b8efcebeb3de",
"target": {
"file": "drivers/platform/x86/intel/speed_select_if/isst_if_common.c",
"function": "_isst_if_get_pci_dev"
}
},
{
"id": "CVE-2024-49886-3425ec82",
"signature_version": "v1",
"digest": {
"length": 993.0,
"function_hash": "15234586025030545842501140530383430669"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8176d4878ed2af5d93ddd0e971e24c412124d38b",
"target": {
"file": "drivers/platform/x86/intel/speed_select_if/isst_if_common.c",
"function": "_isst_if_get_pci_dev"
}
},
{
"id": "CVE-2024-49886-39324aec",
"signature_version": "v1",
"digest": {
"length": 993.0,
"function_hash": "15234586025030545842501140530383430669"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdd03afcb6eda3103da5a0948d3db12372f62910",
"target": {
"file": "drivers/platform/x86/intel/speed_select_if/isst_if_common.c",
"function": "_isst_if_get_pci_dev"
}
},
{
"id": "CVE-2024-49886-59ad211c",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"6808364928820665474100927529679396599",
"163377703155113584586068633662969208044",
"29309802914820109368214766534611503576",
"311240290047107469255931958387565868259"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cdd03afcb6eda3103da5a0948d3db12372f62910",
"target": {
"file": "drivers/platform/x86/intel/speed_select_if/isst_if_common.c"
}
},
{
"id": "CVE-2024-49886-682ef4c6",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"6808364928820665474100927529679396599",
"163377703155113584586068633662969208044",
"29309802914820109368214766534611503576",
"311240290047107469255931958387565868259"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8176d4878ed2af5d93ddd0e971e24c412124d38b",
"target": {
"file": "drivers/platform/x86/intel/speed_select_if/isst_if_common.c"
}
},
{
"id": "CVE-2024-49886-71f755b0",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"6808364928820665474100927529679396599",
"163377703155113584586068633662969208044",
"29309802914820109368214766534611503576",
"311240290047107469255931958387565868259"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cebc705b097d5c16469b141a25e840161d1c517a",
"target": {
"file": "drivers/platform/x86/intel/speed_select_if/isst_if_common.c"
}
},
{
"id": "CVE-2024-49886-bafbeb75",
"signature_version": "v1",
"digest": {
"length": 993.0,
"function_hash": "15234586025030545842501140530383430669"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1973c4d8ee0782a808303d75e3be9c12baaacd97",
"target": {
"file": "drivers/platform/x86/intel/speed_select_if/isst_if_common.c",
"function": "_isst_if_get_pci_dev"
}
},
{
"id": "CVE-2024-49886-bd66f43f",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"6808364928820665474100927529679396599",
"163377703155113584586068633662969208044",
"29309802914820109368214766534611503576",
"311240290047107469255931958387565868259"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d59ac07ccb58f8f604f8057db63b8efcebeb3de",
"target": {
"file": "drivers/platform/x86/intel/speed_select_if/isst_if_common.c"
}
},
{
"id": "CVE-2024-49886-c01d8a0d",
"signature_version": "v1",
"digest": {
"length": 993.0,
"function_hash": "15234586025030545842501140530383430669"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afa7f78d9a907cfded6c98c91aae2bf7b3b56e51",
"target": {
"file": "drivers/platform/x86/intel/speed_select_if/isst_if_common.c",
"function": "_isst_if_get_pci_dev"
}
},
{
"id": "CVE-2024-49886-ead4a8e9",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"6808364928820665474100927529679396599",
"163377703155113584586068633662969208044",
"29309802914820109368214766534611503576",
"311240290047107469255931958387565868259"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@afa7f78d9a907cfded6c98c91aae2bf7b3b56e51",
"target": {
"file": "drivers/platform/x86/intel/speed_select_if/isst_if_common.c"
}
},
{
"id": "CVE-2024-49886-f85846f3",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"6808364928820665474100927529679396599",
"163377703155113584586068633662969208044",
"29309802914820109368214766534611503576",
"311240290047107469255931958387565868259"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1973c4d8ee0782a808303d75e3be9c12baaacd97",
"target": {
"file": "drivers/platform/x86/intel/speed_select_if/isst_if_common.c"
}
}
]
Linux / Kernel
Package
- Name
- Kernel
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.15.168
- Type
- ECOSYSTEM
- Events
-
Introduced5.16.0Fixed6.1.113
- Type
- ECOSYSTEM
- Events
-
Introduced6.0.0Fixed6.6.55
- Type
- ECOSYSTEM
- Events
-
Introduced6.2.0Fixed6.10.14
- Type
- ECOSYSTEM
- Events
-
Introduced6.7.0Fixed6.11.3