CVE-2024-50133: LoongArch: Don't crash in stack_top() for tasks without vDSO
First published: Tue Nov 05 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Don't crash in stack_top() for tasks without vDSO Not all tasks have a vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL vdso pointer and crash. This can for example happen when using kunit: [<9000000000203874>] stack_top+0x58/0xa8 [<90000000002956cc>] arch_pick_mmap_layout+0x164/0x220 [<90000000003c284c>] kunit_vm_mmap_init+0x108/0x12c [<90000000003c1fbc>] __kunit_add_resource+0x38/0x8c [<90000000003c2704>] kunit_vm_mmap+0x88/0xc8 [<9000000000410b14>] usercopy_test_init+0xbc/0x25c [<90000000003c1db4>] kunit_try_run_case+0x5c/0x184 [<90000000003c3d54>] kunit_generic_run_threadfn_adapter+0x24/0x48 [<900000000022e4bc>] kthread+0xc8/0xd4 [<9000000000200ce8>] ret_from_kernel_thread+0xc/0xa4
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | >=5.19<6.1.115 | |
| Linux Kernel | >=6.2<6.6.59 | |
| Linux Kernel | >=6.7<6.11.6 | |
| Linux Kernel | =6.12-rc1 | |
| Linux Kernel | =6.12-rc2 | |
| Linux Kernel | =6.12-rc3 | |
| Linux Kernel | =6.12-rc4 | |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.123-1 6.1.128-1 6.12.12-1 6.12.15-1 | |
| debian/linux-6.1 | 6.1.119-1~deb11u1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/a67d4a02bf43e15544179895ede7d5f97b84b550
- https://git.kernel.org/stable/c/a94c197d4d749954dfaa37e907fcc8c04e4aad7e
- https://git.kernel.org/stable/c/041cc3860b06770357876d1114d615333b0fbf31
- https://git.kernel.org/stable/c/134475a9ab8487527238d270639a8cb74c10aab2
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50133
- https://nvd.nist.gov/vuln/detail/CVE-2024-50133
- https://launchpad.net/bugs/cve/CVE-2024-50133
- https://security-tracker.debian.org/tracker/CVE-2024-50133
- https://ubuntu.com/security/CVE-2024-50133
- https://git.kernel.org/linus/134475a9ab8487527238d270639a8cb74c10aab2
Frequently Asked Questions
What is the severity of CVE-2024-50133?
CVE-2024-50133 has a severity rating that classifies it as a moderate risk vulnerability in the Linux kernel.
How do I fix CVE-2024-50133?
To fix CVE-2024-50133, you should update your Linux kernel to the latest patched version that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-50133?
CVE-2024-50133 affects multiple versions of the Linux kernel, specifically between versions 5.19 and 6.1.115, 6.2 and 6.6.59, and several release candidates of version 6.12.
What are the potential impacts of CVE-2024-50133?
CVE-2024-50133 could potentially lead to a kernel crash when certain tasks call stack_top() without a mapped vDSO.
Is CVE-2024-50133 specific to any particular architecture?
Yes, CVE-2024-50133 specifically affects the LoongArch architecture within the Linux kernel.
- agent/type
- agent/title
- agent/first-publish-date
- agent/author
- agent/severity
- agent/weakness
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/usn-cve
- source/Ubuntu
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/source
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- vendor/linux
- canonical/linux kernel
- version/linux kernel/5.19
- version/linux kernel/6.2
- version/linux kernel/6.7
- version/linux kernel/6.12-rc1
- version/linux kernel/6.12-rc2
- version/linux kernel/6.12-rc3
- version/linux kernel/6.12-rc4
- package-manager/debian