CVE-2024-26795 riscv: Sparse-Memory/vmemmap out-of-bounds fix

2024-04-0408:20:25

Linux

github.com

linux

kernel

vulnerability

risc-v

memory mapping

physical memory

security patch

AI Score

6.5

Confidence

Low

EPSS

Percentile

10.3%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

In the Linux kernel, the following vulnerability has been resolved:

riscv: Sparse-Memory/vmemmap out-of-bounds fix

Offset vmemmap so that the first page of vmemmap will be mapped
to the first page of physical memory in order to ensure that
vmemmap’s bounds will be respected during
pfn_to_page()/page_to_pfn() operations.
The conversion macros will produce correct SV39/48/57 addresses
for every possible/valid DRAM_BASE inside the physical memory limits.

v2:Address Alex’s comments

CNA Affected

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "d95f1a542c3d",
        "lessThan": "8af1c121b010",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d95f1a542c3d",
        "lessThan": "5941a90c55d3",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d95f1a542c3d",
        "lessThan": "8310080799b4",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d95f1a542c3d",
        "lessThan": "a278d5c60f21",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d95f1a542c3d",
        "lessThan": "2a1728c15ec4",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "d95f1a542c3d",
        "lessThan": "a11dd49dcb93",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "arch/riscv/include/asm/pgtable.h"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.4"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.4",
        "versionType": "custom"
      },
      {
        "status": "unaffected",
        "version": "5.10.212",
        "versionType": "custom",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.151",
        "versionType": "custom",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.81",
        "versionType": "custom",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.21",
        "versionType": "custom",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.7.9",
        "versionType": "custom",
        "lessThanOrEqual": "6.7.*"
      },
      {
        "status": "unaffected",
        "version": "6.8",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "arch/riscv/include/asm/pgtable.h"
    ],
    "defaultStatus": "affected"
  }
]