CVE-2024-41032: mm: vmalloc: check if a hash-index is in cpu_possible_mask
In the Linux kernel, the following vulnerability has been resolved:
mm: vmalloc: check if a hash-index is in cpupossiblemask
The problem is that there are systems where cpupossiblemask has gaps between set CPUs, for example SPARC. In this scenario addrtovbxa() hash function can return an index which accesses to not-possible and not setup CPU area using percpu() macro. This results in an oops on SPARC.
A per-cpu vmapblockqueue is also used as hash table, incorrectly assuming the cpupossiblemask has no gaps. Fix it by adjusting an index to a next possible CPU.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.41 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9.10 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Configuration
Apply the fix in mm/vmalloc so addr_to_vb_xa() verifies that the computed hash-index is present in cpu_possible_mask; if not, adjust the index to the next possible CPU before using per_cpu() access.
Linux kernel mm/vmalloc (addr_to_vb_xa hash index handling) hash-index bounds check against cpu_possible_mask = Adjust hash index to a next possible CPU within cpu_possible_mask (avoid indices for not-possible CPUs)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41032?
CVE-2024-41032 has a medium severity rating due to its potential impact on the Linux kernel's memory management.
How do I fix CVE-2024-41032?
To fix CVE-2024-41032, update your Linux kernel to one of the patched versions including 6.6.41, 6.9.10, 6.10, or specific versions from Debian.
What systems are affected by CVE-2024-41032?
CVE-2024-41032 affects systems running specific versions of the Linux kernel, especially those with gaps in cpu_possible_mask.
Who is responsible for the patch of CVE-2024-41032?
The patch for CVE-2024-41032 has been released by the Linux kernel maintainers and is available through various distributions.
What type of vulnerability is CVE-2024-41032?
CVE-2024-41032 is a memory management vulnerability in the Linux kernel concerning the handling of hash indices related to CPU masks.