CVE-2024-46847: mm: vmalloc: ensure vmap_block is initialised before adding to queue
In the Linux kernel, the following vulnerability has been resolved:
mm: vmalloc: ensure vmapblock is initialised before adding to queue
Commit 8c61291fd850 ("mm: fix incorrect vbq reference in purgefragmentedblock") extended the 'vmapblock' structure to contain a 'cpu' field which is set at allocation time to the id of the initialising CPU.
When a new 'vmapblock' is being instantiated by newvmapblock(), the partially initialised structure is added to the local 'vmapblockqueue' xarray before the 'cpu' field has been initialised. If another CPU is concurrently walking the xarray (e.g. via vmunmapaliases()), then it may perform an out-of-bounds access to the remote queue thanks to an uninitialised index.
This has been observed as UBSAN errors in Android:
| Internal error: UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP | | Call trace: | purgefragmentedblock+0x204/0x21c | vmunmapaliases+0x170/0x378 | vmunmapaliases+0x1c/0x28 | changememorycommon+0x1dc/0x26c | setmemoryro+0x18/0x24 | moduleenablero+0x98/0x238 | doinitmodule+0x1b0/0x310
Move the initialisation of 'vb->cpu' in newvmapblock() ahead of the addition to the xarray.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 8c61291fd850 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch Commit 8c61291fd850 (
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46847?
The severity of CVE-2024-46847 is classified as medium risk.
How do I fix CVE-2024-46847?
To fix CVE-2024-46847, update the Linux kernel to a version that is not affected by this vulnerability.
Which versions of Linux kernel are affected by CVE-2024-46847?
CVE-2024-46847 affects Linux kernel versions between 6.6.37 and 6.6.51, 6.9.8 and 6.10, and multiple release candidates of 6.11.
Is there a patch available for CVE-2024-46847?
Yes, a patch for CVE-2024-46847 is available in the updated versions of the Linux kernel.
What is the cause of CVE-2024-46847?
CVE-2024-46847 is caused by improper initialization of the 'vmap_block' structure in the Linux kernel.