In the Linux kernel, the following vulnerability has been resolved:
comedi: Flush partial mappings in error case
If some remappfnrange() calls succeeded before one failed, we still have buffer pages mapped into the userspace page tables when we drop the buffer reference with comedibufmap_put(bm). The userspace mappings are only cleaned up later in the mmap error path.
Fix it by explicitly flushing all mappings in our VMA on the error path.
See commit 79a61cc3fc04 ("mm: avoid leaving partial pfn mappings around in error case").
[
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"318714583001023237180562977059950715771",
"41910344002654743492251779526215357144",
"24819023155557742861827985887804521681",
"122867299097648433787228414863095069760"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b07fb464eb69a752406e78e62ab3a60bfa7b00d",
"target": {
"file": "drivers/comedi/comedi_fops.c"
},
"id": "CVE-2024-53148-0c98d2a5"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1717.0,
"function_hash": "272854751469974783544600971091996790120"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57f048c2d205b85e34282a9b0b0ae177e84c2f44",
"target": {
"file": "drivers/staging/comedi/comedi_fops.c",
"function": "comedi_mmap"
},
"id": "CVE-2024-53148-30a98634"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1717.0,
"function_hash": "272854751469974783544600971091996790120"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16c507df509113c037cdc0ba642b9ab3389bd26c",
"target": {
"file": "drivers/comedi/comedi_fops.c",
"function": "comedi_mmap"
},
"id": "CVE-2024-53148-382e8a82"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"318714583001023237180562977059950715771",
"41910344002654743492251779526215357144",
"24819023155557742861827985887804521681",
"122867299097648433787228414863095069760"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6963a06ce5c61d3238751ada04ee1569663a828",
"target": {
"file": "drivers/comedi/comedi_fops.c"
},
"id": "CVE-2024-53148-733f2a55"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1717.0,
"function_hash": "272854751469974783544600971091996790120"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b07fb464eb69a752406e78e62ab3a60bfa7b00d",
"target": {
"file": "drivers/comedi/comedi_fops.c",
"function": "comedi_mmap"
},
"id": "CVE-2024-53148-7a39ca9d"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1717.0,
"function_hash": "272854751469974783544600971091996790120"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6963a06ce5c61d3238751ada04ee1569663a828",
"target": {
"file": "drivers/comedi/comedi_fops.c",
"function": "comedi_mmap"
},
"id": "CVE-2024-53148-963fbcf9"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"318714583001023237180562977059950715771",
"41910344002654743492251779526215357144",
"24819023155557742861827985887804521681",
"122867299097648433787228414863095069760"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8797b7712de704dc231f9e821d8eb3b9aeb3a032",
"target": {
"file": "drivers/comedi/comedi_fops.c"
},
"id": "CVE-2024-53148-9762a1e5"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1717.0,
"function_hash": "272854751469974783544600971091996790120"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8797b7712de704dc231f9e821d8eb3b9aeb3a032",
"target": {
"file": "drivers/comedi/comedi_fops.c",
"function": "comedi_mmap"
},
"id": "CVE-2024-53148-b07b2688"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"318714583001023237180562977059950715771",
"41910344002654743492251779526215357144",
"24819023155557742861827985887804521681",
"122867299097648433787228414863095069760"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57f048c2d205b85e34282a9b0b0ae177e84c2f44",
"target": {
"file": "drivers/staging/comedi/comedi_fops.c"
},
"id": "CVE-2024-53148-b745f6ea"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"318714583001023237180562977059950715771",
"41910344002654743492251779526215357144",
"24819023155557742861827985887804521681",
"122867299097648433787228414863095069760"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16c507df509113c037cdc0ba642b9ab3389bd26c",
"target": {
"file": "drivers/comedi/comedi_fops.c"
},
"id": "CVE-2024-53148-df4c56a9"
}
]