CVE-2024-36019: regmap: maple: Fix cache corruption in regcache_maple_drop()
In the Linux kernel, the following vulnerability has been resolved:
regmap: maple: Fix cache corruption in regcachemapledrop()
The Linux kernel CVE team has assigned CVE-2024-36019 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024053044-CVE-2024-36019-59fb@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
regmap: maple: Fix cache corruption in regcachemapledrop()
When keeping the upper end of a cache block entry, the entry[] array must be indexed by the offset from the base register of the block, i.e. max - mas.index.
The code was indexing entry[] by only the register address, leading to an out-of-bounds access that copied some part of the kernel memory over the cache contents.
This bug was not detected by the regmap KUnit test because it only tests with a block of registers starting at 0, so mas.index == 0.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.26 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.5 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36019?
CVE-2024-36019 has been assigned a severity level that indicates it poses a risk of cache corruption in the Linux kernel.
How do I fix CVE-2024-36019?
To fix CVE-2024-36019, update your Linux kernel to one of the patched versions such as 6.6.26, 6.8.5, 6.9, or applicable versions from Debian.
Which Linux kernel versions are vulnerable to CVE-2024-36019?
Linux kernel versions prior to 6.6.26, 6.8.5, and 6.9, along with certain versions in Debian, are vulnerable to CVE-2024-36019.
What is the impact of CVE-2024-36019 on system stability?
CVE-2024-36019 can lead to cache corruption, which may result in unpredictable behavior and potential system crashes.
Has CVE-2024-36019 been patched?
Yes, CVE-2024-36019 has been patched in newer kernel releases, addressing the cache corruption issue.