In the Linux kernel, the following vulnerability has been resolved:
riscv: mm: Fix the out of bound issue of vmemmap address
In sparse vmemmap model, the virtual address of vmemmap is calculated as: ((struct page *)VMEMMAPSTART - (physrambase >> PAGESHIFT)). And the struct page's va can be calculated with an offset: (vmemmap + (pfn)).
However, when initializing struct pages, kernel actually starts from the first page from the same section that physrambase belongs to. If the first page's physical address is not (physrambase >> PAGESHIFT), then we get an va below VMEMMAPSTART when calculating va for it's struct page.
For example, if physrambase starts from 0x82000000 with pfn 0x82000, the first page in the same section is actually pfn 0x80000. During initunavailablerange(), we will initialize struct page for pfn 0x80000 with virtual address ((struct page *)VMEMMAPSTART - 0x2000), which is below VMEMMAPSTART as well as PCIIOEND.
This commit fixes this bug by introducing a new variable 'vmemmapstartpfn' which is aligned with memory section size and using it to calculate vmemmap address instead of physrambase.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/57xxx/CVE-2024-57945.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-57945.json"
[
{
"id": "CVE-2024-57945-000e63fc",
"target": {
"file": "arch/riscv/mm/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92f08673d3f1893191323572f60e3c62f2e57c2f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"314499644574096810101635238456464586585",
"219255297043222953066094258542065020348",
"57079158014299243759892408290894477900",
"208130045516394377335585102698087857282",
"213679025307238005791960595915838676196",
"195621152356127645613736769735080812202",
"314141797184238737033194768656333375892",
"214619758373206375928673392307136965228",
"339080924506299445025987099342914534455",
"289127812684417355055885053800858269796",
"296285924334939346696434065810737457290",
"318226996561963153443173650277350555983",
"95897892109494591111319020904904816770",
"231801081800784125010544464313292950178",
"276513871756031676989597006614642371897",
"32175844138825480236193027198417214830"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2024-57945-02d7ea41",
"target": {
"file": "arch/riscv/include/asm/page.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92f08673d3f1893191323572f60e3c62f2e57c2f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"62203583277374062458785942979245234077",
"286459629936430492781255296913744605257",
"29830790158769743503926557272951420395",
"121747131924119169551793229641483618076"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2024-57945-04bded65",
"target": {
"function": "setup_bootmem",
"file": "arch/riscv/mm/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2bd51954ac8377c2f1eb1813e694788998add66",
"digest": {
"function_hash": "105651234658184959978666728339580970245",
"length": 1395.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-57945-1038ebe0",
"target": {
"function": "setup_bootmem",
"file": "arch/riscv/mm/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f754f27e98f88428aaf6be6e00f5cbce97f62d4b",
"digest": {
"function_hash": "105651234658184959978666728339580970245",
"length": 1395.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-57945-1c265867",
"target": {
"file": "arch/riscv/mm/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f754f27e98f88428aaf6be6e00f5cbce97f62d4b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"100244190734990571172405524573000354863",
"340031483248889788227369604831682296762",
"31781864096107960569638968604795984464",
"278960564644917177178207195722363394513",
"319321548448228670464221629940975611128",
"195621152356127645613736769735080812202",
"314141797184238737033194768656333375892",
"166946192870371377726253436812440301890",
"194954774402844345992650003617636113379",
"111464033230676726401711240713492156207",
"122869367549796731157403499592825727562",
"3238013643408487519221111064470691617",
"64439067633511318465757923006864692280",
"231801081800784125010544464313292950178",
"276513871756031676989597006614642371897",
"62519731798363554867573339309622258397"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2024-57945-1c9b15b0",
"target": {
"function": "setup_bootmem",
"file": "arch/riscv/mm/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a4a7ac3d266008018f05fae53060fcb331151a14",
"digest": {
"function_hash": "105651234658184959978666728339580970245",
"length": 1395.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-57945-242f1dfa",
"target": {
"function": "setup_vm",
"file": "arch/riscv/mm/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a4a7ac3d266008018f05fae53060fcb331151a14",
"digest": {
"function_hash": "33985661264169091811036836721499356316",
"length": 3903.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-57945-2cd74f5a",
"target": {
"function": "setup_vm",
"file": "arch/riscv/mm/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f754f27e98f88428aaf6be6e00f5cbce97f62d4b",
"digest": {
"function_hash": "285937868512655375680122589295528943780",
"length": 4058.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-57945-3163088c",
"target": {
"file": "arch/riscv/include/asm/page.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2bd51954ac8377c2f1eb1813e694788998add66",
"digest": {
"threshold": 0.9,
"line_hashes": [
"62203583277374062458785942979245234077",
"286459629936430492781255296913744605257",
"29830790158769743503926557272951420395",
"266350472262642642439290724586334293469"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2024-57945-32897d68",
"target": {
"function": "setup_bootmem",
"file": "arch/riscv/mm/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92f08673d3f1893191323572f60e3c62f2e57c2f",
"digest": {
"function_hash": "309207277116286161158898651677757817403",
"length": 1101.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-57945-5e39b552",
"target": {
"function": "setup_vm",
"file": "arch/riscv/mm/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2bd51954ac8377c2f1eb1813e694788998add66",
"digest": {
"function_hash": "285937868512655375680122589295528943780",
"length": 4058.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-57945-70b5723a",
"target": {
"file": "arch/riscv/include/asm/page.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f754f27e98f88428aaf6be6e00f5cbce97f62d4b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"62203583277374062458785942979245234077",
"286459629936430492781255296913744605257",
"29830790158769743503926557272951420395",
"266350472262642642439290724586334293469"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2024-57945-8462ad8d",
"target": {
"function": "setup_vm",
"file": "arch/riscv/mm/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@92f08673d3f1893191323572f60e3c62f2e57c2f",
"digest": {
"function_hash": "114952159323837348844495741106822279622",
"length": 3346.0
},
"signature_type": "Function"
},
{
"id": "CVE-2024-57945-8e22ec08",
"target": {
"file": "arch/riscv/mm/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2bd51954ac8377c2f1eb1813e694788998add66",
"digest": {
"threshold": 0.9,
"line_hashes": [
"100244190734990571172405524573000354863",
"340031483248889788227369604831682296762",
"31781864096107960569638968604795984464",
"278960564644917177178207195722363394513",
"319321548448228670464221629940975611128",
"195621152356127645613736769735080812202",
"314141797184238737033194768656333375892",
"166946192870371377726253436812440301890",
"194954774402844345992650003617636113379",
"111464033230676726401711240713492156207",
"122869367549796731157403499592825727562",
"3238013643408487519221111064470691617",
"64439067633511318465757923006864692280",
"231801081800784125010544464313292950178",
"276513871756031676989597006614642371897",
"62519731798363554867573339309622258397"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2024-57945-b973cbed",
"target": {
"file": "arch/riscv/mm/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a4a7ac3d266008018f05fae53060fcb331151a14",
"digest": {
"threshold": 0.9,
"line_hashes": [
"173466240734137141365121006237621139034",
"251161860199636003268745816230363686433",
"31781864096107960569638968604795984464",
"338009946136572225973877899738199187263",
"213679025307238005791960595915838676196",
"195621152356127645613736769735080812202",
"314141797184238737033194768656333375892",
"166946192870371377726253436812440301890",
"194954774402844345992650003617636113379",
"111464033230676726401711240713492156207",
"122869367549796731157403499592825727562",
"3238013643408487519221111064470691617",
"64439067633511318465757923006864692280",
"231801081800784125010544464313292950178",
"276513871756031676989597006614642371897",
"32175844138825480236193027198417214830"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2024-57945-ecaad7f8",
"target": {
"file": "arch/riscv/include/asm/page.h"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a4a7ac3d266008018f05fae53060fcb331151a14",
"digest": {
"threshold": 0.9,
"line_hashes": [
"62203583277374062458785942979245234077",
"286459629936430492781255296913744605257",
"29830790158769743503926557272951420395",
"266350472262642642439290724586334293469"
]
},
"signature_type": "Line"
}
]