CVE-2024-56673

{"id": "CVE-2024-56673", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-12-27T15:15:27.210", "references": [{"url": "https://git.kernel.org/stable/c/21f1b85c8912262adf51707e63614a114425eb10", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/344945806f2f7af68be98bac02836c867f223aa9", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: mm: Do not call pmd dtor on vmemmap page table teardown\n\nThe vmemmap's, which is used for RV64 with SPARSEMEM_VMEMMAP, page\ntables are populated using pmd (page middle directory) hugetables.\nHowever, the pmd allocation is not using the generic mechanism used by\nthe VMA code (e.g. pmd_alloc()), or the RISC-V specific\ncreate_pgd_mapping()/alloc_pmd_late(). Instead, the vmemmap page table\ncode allocates a page, and calls vmemmap_set_pmd(). This results in\nthat the pmd ctor is *not* called, nor would it make sense to do so.\n\nNow, when tearing down a vmemmap page table pmd, the cleanup code\nwould unconditionally, and incorrectly call the pmd dtor, which\nresults in a crash (best case).\n\nThis issue was found when running the HMM selftests:\n\n | tools/testing/selftests/mm# ./test_hmm.sh smoke\n | ... # when unloading the test_hmm.ko module\n | page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10915b\n | flags: 0x1000000000000000(node=0|zone=1)\n | raw: 1000000000000000 0000000000000000 dead000000000122 0000000000000000\n | raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000\n | page dumped because: VM_BUG_ON_PAGE(ptdesc->pmd_huge_pte)\n | ------------[ cut here ]------------\n | kernel BUG at include/linux/mm.h:3080!\n | Kernel BUG [#1]\n | Modules linked in: test_hmm(-) sch_fq_codel fuse drm drm_panel_orientation_quirks backlight dm_mod\n | CPU: 1 UID: 0 PID: 514 Comm: modprobe Tainted: G W 6.12.0-00982-gf2a4f1682d07 #2\n | Tainted: [W]=WARN\n | Hardware name: riscv-virtio qemu/qemu, BIOS 2024.10 10/01/2024\n | epc : remove_pgd_mapping+0xbec/0x1070\n | ra : remove_pgd_mapping+0xbec/0x1070\n | epc : ffffffff80010a68 ra : ffffffff80010a68 sp : ff20000000a73940\n | gp : ffffffff827b2d88 tp : ff6000008785da40 t0 : ffffffff80fbce04\n | t1 : 0720072007200720 t2 : 706d756420656761 s0 : ff20000000a73a50\n | s1 : ff6000008915cff8 a0 : 0000000000000039 a1 : 0000000000000008\n | a2 : ff600003fff0de20 a3 : 0000000000000000 a4 : 0000000000000000\n | a5 : 0000000000000000 a6 : c0000000ffffefff a7 : ffffffff824469b8\n | s2 : ff1c0000022456c0 s3 : ff1ffffffdbfffff s4 : ff6000008915c000\n | s5 : ff6000008915c000 s6 : ff6000008915c000 s7 : ff1ffffffdc00000\n | s8 : 0000000000000001 s9 : ff1ffffffdc00000 s10: ffffffff819a31f0\n | s11: ffffffffffffffff t3 : ffffffff8000c950 t4 : ff60000080244f00\n | t5 : ff60000080244000 t6 : ff20000000a73708\n | status: 0000000200000120 badaddr: ffffffff80010a68 cause: 0000000000000003\n | [<ffffffff80010a68>] remove_pgd_mapping+0xbec/0x1070\n | [<ffffffff80fd238e>] vmemmap_free+0x14/0x1e\n | [<ffffffff8032e698>] section_deactivate+0x220/0x452\n | [<ffffffff8032ef7e>] sparse_remove_section+0x4a/0x58\n | [<ffffffff802f8700>] __remove_pages+0x7e/0xba\n | [<ffffffff803760d8>] memunmap_pages+0x2bc/0x3fe\n | [<ffffffff02a3ca28>] dmirror_device_remove_chunks+0x2ea/0x518 [test_hmm]\n | [<ffffffff02a3e026>] hmm_dmirror_exit+0x3e/0x1018 [test_hmm]\n | [<ffffffff80102c14>] __riscv_sys_delete_module+0x15a/0x2a6\n | [<ffffffff80fd020c>] do_trap_ecall_u+0x1f2/0x266\n | [<ffffffff80fde0a2>] _new_vmalloc_restore_context_a0+0xc6/0xd2\n | Code: bf51 7597 0184 8593 76a5 854a 4097 0029 80e7 2c00 (9002) 7597\n | ---[ end trace 0000000000000000 ]---\n | Kernel panic - not syncing: Fatal exception in interrupt\n\nAdd a check to avoid calling the pmd dtor, if the calling context is\nvmemmap_free()."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: riscv: mm: No llamar a pmd dtor en el desmontaje de la tabla de p\u00e1ginas vmemmap Las tablas de p\u00e1ginas vmemmap, que se utilizan para RV64 con SPARSEMEM_VMEMMAP, se rellenan utilizando enormes tablas pmd (directorio intermedio de p\u00e1ginas). Sin embargo, la asignaci\u00f3n de pmd no utiliza el mecanismo gen\u00e9rico utilizado por el c\u00f3digo VMA (por ejemplo, pmd_alloc()), o el create_pgd_mapping()/alloc_pmd_late() espec\u00edfico de RISC-V. En su lugar, el c\u00f3digo de la tabla de p\u00e1ginas vmemmap asigna una p\u00e1gina y llama a vmemmap_set_pmd(). Esto da como resultado que el pmd ctor *no* se llame, ni tendr\u00eda sentido hacerlo. Ahora, al desmantelar un pmd de la tabla de p\u00e1ginas vmemmap, el c\u00f3digo de desinfecci\u00f3n llamar\u00eda incondicional e incorrectamente al pmd dtor, lo que da como resultado un bloqueo (en el mejor de los casos). Este problema se encontr\u00f3 al ejecutar las autopruebas de HMM: | herramientas/pruebas/autopruebas/mm# ./test_hmm.sh smoke | ... # al descargar el m\u00f3dulo test_hmm.ko | p\u00e1gina: refcount:1 mapcount:0 mapping:0000000000000000 \u00edndice:0x0 pfn:0x10915b | banderas: 0x1000000000000000(nodo=0|zona=1) | crudo: 1000000000000000 0000000000000000 dead0000000000122 0000000000000000 | raw: 0000000000000000 000000000000000 00000001ffffffff 0000000000000000 | p\u00e1gina volcada porque: VM_BUG_ON_PAGE(ptdesc-&gt;pmd_huge_pte) | ------------[ cortar aqu\u00ed ]------------ | \u00a1ERROR del kernel en include/linux/mm.h:3080! | ERROR del kernel [#1] | M\u00f3dulos vinculados en: test_hmm(-) sch_fq_codel fuse drm drm_panel_orientation_quirks backlight dm_mod | CPU: 1 UID: 0 PID: 514 Comm: modprobe Contaminado: GW 6.12.0-00982-gf2a4f1682d07 #2 | Contaminado: [W]=WARN | Nombre del hardware: riscv-virtio qemu/qemu, BIOS 2024.10 10/01/2024 | epc : remove_pgd_mapping+0xbec/0x1070 | ra : remove_pgd_mapping+0xbec/0x1070 | epc : ffffffff80010a68 ra : ffffffff80010a68 sp : ff20000000a73940 | gp : ffffffff827b2d88 tp : ff6000008785da40 t0 : ffffffff80fbce04 | t1: 0720072007200720 t2: 706d756420656761 s0: ff20000000a73a50 | s1: ff6000008915cff8 a0: 0000000000000039 a1: 00000000000000008 | a2: ff600003fff0de20 a3: 0000000000000000 a4: 0000000000000000 | a5: 0000000000000000 a6: c0000000fffffff a7: ffffffff824469b8 | s2: ff1c0000022456c0 s3: ff1ffffffdbfffff s4: ff6000008915c000 | s5: ff6000008915c000 s6: ff6000008915c000 s7: ff1ffffffdc00000 | s8: 0000000000000001 s9: ff1ffffffdc00000 s10: ffffffff819a31f0 | s11: ffffffffffffffff t3: ffffffff8000c950 t4: ff60000080244f00 | t5 : ff60000080244000 t6 : ff20000000a73708 | estado: 0000000200000120 direcci\u00f3n incorrecta: ffffffff80010a68 causa: 0000000000000003 | [] eliminar_map_pgd+0xbec/0x1070 | [] vmemmap_free+0x14/0x1e | [] desactivar_secci\u00f3n+0x220/0x452 | [] eliminar_secci\u00f3n_sparse+0x4a/0x58 | [] __eliminar_p\u00e1ginas+0x7e/0xba | [] memunmap_p\u00e1ginas+0x2bc/0x3fe | [] dmirror_dispositivo_eliminar_fragmentos+0x2ea/0x518 [prueba_hmm] | [] hmm_dmirror_exit+0x3e/0x1018 [prueba_hmm] | [] __riscv_sys_eliminar_m\u00f3dulo+0x15a/0x2a6 | [] do_trap_ecall_u+0x1f2/0x266 | [] _new_vmalloc_restore_context_a0+0xc6/0xd2 | C\u00f3digo: bf51 7597 0184 8593 76a5 854a 4097 0029 80e7 2c00 (9002) 7597 | ---[ fin del seguimiento 000000000000000 ]--- | P\u00e1nico del kernel - no sincroniza: Excepci\u00f3n fatal en la interrupci\u00f3n Agregue una verificaci\u00f3n para evitar llamar al dtor pmd, si el contexto de llamada es vmemmap_free()."}], "lastModified": "2025-01-06T15:08:36.363", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "97C759FD-3999-4EA7-B961-1CADF641F560", "versionEndExcluding": "6.12.6", "versionStartIncluding": "6.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62567B3C-6CEE-46D0-BC2E-B3717FBF7D13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5A073481-106D-4B15-B4C7-FB0213B8E1D4"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}