CVE-2024-56677: powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()
In the Linux kernel, the following vulnerability has been resolved:
powerpc/fadump: Move fadumpcmainit to setuparch() after initmeminit()
During early init CMAMINALIGNMENTBYTES can be PAGESIZE, since pageblockorder is still zero and it gets initialized later during initmeminit() e.g. setuparch() -> initmeminit() -> sparseinit() -> setpageblockorder()
One such use case where this causes issue is - earlysetup() -> earlyinitdevtree() -> fadumpreservemem() -> fadumpcmainit()
This causes CMA memory alignment check to be bypassed in cmainitreservedmem(). Then later cmaactivatearea() can hit a VMBUGONPAGE(pfn & ((1 << order) - 1)) if the reserved memory area was not pageblockorder aligned.
Fix it by moving the fadumpcmainit() after initmeminit(), where other such cma reservations also gets called.
<stack trace> ============== page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10010 flags: 0x13ffff800000000(node=1|zone=0|lastcpupid=0x7ffff) CMA raw: 013ffff800000000 5deadbeef0000100 5deadbeef0000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: VMBUGONPAGE(pfn & ((1 << order) - 1)) ------------[ cut here ]------------ kernel BUG at mm/pagealloc.c:778!
Call Trace: freeonepage+0x57c/0x7b0 (unreliable) freepcppagesbulk+0x1a8/0x2c8 freeunrefpagecommit+0x3d4/0x4e4 freeunrefpage+0x458/0x6d0 initcmareservedpageblock+0x114/0x198 cmainitreservedareas+0x270/0x3e0 dooneinitcall+0x80/0x2f8 kernelinitfreeable+0x33c/0x530 kernelinit+0x34/0x26c retfromkerneluserthread+0x14/0x1c
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
In the powerpc/fadump code, change initialization so fadump_cma_init() is called from setup_arch() after initmem_init(). This ensures CMA_MIN_ALIGNMENT_BYTES is initialized after pageblock_order is set (via initmem_init() -> sparse_init() -> set_pageblock_order()), preventing cma_init_reserved_mem() from bypassing the CMA memory alignment check (VM_BUG_ON_PAGE(pfn & ((1 << order) - 1))).
Linux kernel (powerpc/fadump) fadump_cma_init() initialization order = Move fadump_cma_init to setup_arch() after initmem_init()
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56677?
CVE-2024-56677 has been classified with a severity level by security analysts, which should be consulted in the CVE database for specifics.
How do I fix CVE-2024-56677?
To fix CVE-2024-56677, ensure you update your Linux kernel to the latest stable version that includes the patched code.
What systems are affected by CVE-2024-56677?
CVE-2024-56677 affects systems running specific versions of the Linux Kernel on PowerPC architecture.
What kind of issues does CVE-2024-56677 address?
CVE-2024-56677 addresses a flaw related to the initialization order of CMA_MIN_ALIGNMENT_BYTES during early setup of the Linux kernel.
Is there a workaround for CVE-2024-56677?
There are no recommended workarounds for CVE-2024-56677; updating the kernel is the advised course of action.