high
7.8
CWE
193
Advisory Published
Updated

CVE-2024-46852: dma-buf: heaps: Fix off-by-one in CMA heap fault handler

First published: Fri Sep 27 2024(Updated: )

In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Until VM_DONTEXPAND was added in commit 1c1914d6e8c6 ("dma-buf: heaps: Don't track CMA dma-buf pages under RssFile") it was possible to obtain a mapping larger than the buffer size via mremap and bypass the overflow check in dma_buf_mmap_internal. When using such a mapping to attempt to fault past the end of the buffer, the CMA heap fault handler also checks the fault offset against the buffer size, but gets the boundary wrong by 1. Fix the boundary check so that we don't read off the end of the pages array and insert an arbitrary page in the mapping.

Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Affected SoftwareAffected VersionHow to fix
Linux Kernel>=5.11<6.1.111
Linux Kernel>=6.2<6.6.52
Linux Kernel>=6.7<6.10.11
Linux Kernel=6.11-rc1
Linux Kernel=6.11-rc2
Linux Kernel=6.11-rc3
Linux Kernel=6.11-rc4
Linux Kernel=6.11-rc5
Linux Kernel=6.11-rc6
Linux Kernel=6.11-rc7
debian/linux
5.10.223-1
5.10.226-1
6.1.123-1
6.1.128-1
6.12.12-1
6.12.13-1
debian/linux-6.1
6.1.119-1~deb11u1

Remedy

https://git.kernel.org/stable/c/84175dc5b2c932266a50c04e5ce342c30f817a2f

Remedy

https://git.kernel.org/stable/c/e79050882b857c37634baedbdcf7c2047c24cbff

Remedy

https://git.kernel.org/stable/c/ea5ff5d351b520524019f7ff7f9ce418de2dad87

Remedy

https://git.kernel.org/stable/c/eb7fc8b65cea22f9038c52398c8b22849e9620ea

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2024-46852?

    CVE-2024-46852 has not been assigned a CVSS score yet, but it addresses a critical off-by-one error in the Linux kernel's CMA heap fault handler.

  • How do I fix CVE-2024-46852?

    To mitigate CVE-2024-46852, update your Linux kernel to a patched version such as 5.10.223-1, 5.10.226-1, 6.1.123-1, or 6.12.11-1.

  • Which Linux kernel versions are affected by CVE-2024-46852?

    CVE-2024-46852 affects Linux kernel versions between 5.11 and 6.6.52, as well as several release candidates of 6.11.

  • What does the CVE-2024-46852 vulnerability impact?

    CVE-2024-46852 can potentially allow an attacker to exploit memory handling issues in kernel space, leading to privilege escalation.

  • Is there a workaround for CVE-2024-46852?

    Currently, the recommended resolution for CVE-2024-46852 is to apply the latest security patches rather than relying on workarounds.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203