CVE-2024-56677 (GCVE-0-2024-56677)

Vulnerability from cvelistv5 – Published: 2024-12-28 09:46 – Updated: 2026-08-05 11:46
VLAI
Title
powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()
Summary
In the Linux kernel, the following vulnerability has been resolved: powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init() During early init CMA_MIN_ALIGNMENT_BYTES can be PAGE_SIZE, since pageblock_order is still zero and it gets initialized later during initmem_init() e.g. setup_arch() -> initmem_init() -> sparse_init() -> set_pageblock_order() One such use case where this causes issue is - early_setup() -> early_init_devtree() -> fadump_reserve_mem() -> fadump_cma_init() This causes CMA memory alignment check to be bypassed in cma_init_reserved_mem(). Then later cma_activate_area() can hit a VM_BUG_ON_PAGE(pfn & ((1 << order) - 1)) if the reserved memory area was not pageblock_order aligned. Fix it by moving the fadump_cma_init() after initmem_init(), where other such cma reservations also gets called. <stack trace> ============== page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10010 flags: 0x13ffff800000000(node=1|zone=0|lastcpupid=0x7ffff) CMA raw: 013ffff800000000 5deadbeef0000100 5deadbeef0000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: VM_BUG_ON_PAGE(pfn & ((1 << order) - 1)) ------------[ cut here ]------------ kernel BUG at mm/page_alloc.c:778! Call Trace: __free_one_page+0x57c/0x7b0 (unreliable) free_pcppages_bulk+0x1a8/0x2c8 free_unref_page_commit+0x3d4/0x4e4 free_unref_page+0x458/0x6d0 init_cma_reserved_pageblock+0x114/0x198 cma_init_reserved_areas+0x270/0x3e0 do_one_initcall+0x80/0x2f8 kernel_init_freeable+0x33c/0x530 kernel_init+0x34/0x26c ret_from_kernel_user_thread+0x14/0x1c
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 11ac3e87ce09c27f4587a8c4fe0829d814021a82 , < aabef6301dcf410dfd2b8759cd413b2a003c7e3f (git)
Affected: 11ac3e87ce09c27f4587a8c4fe0829d814021a82 , < c5c1d1ef70834013fc3bd12b6a0f4664c6d75a74 (git)
Affected: 11ac3e87ce09c27f4587a8c4fe0829d814021a82 , < f551637fe9bf863386309e03f9d148d97f535ad1 (git)
Affected: 11ac3e87ce09c27f4587a8c4fe0829d814021a82 , < 7351c5a6507b4401aeecadb5959131410a339520 (git)
Affected: 11ac3e87ce09c27f4587a8c4fe0829d814021a82 , < 05b94cae1c47f94588c3e7096963c1007c4d9c1d (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.1.120 , ≤ 6.1.* (semver)
Unaffected: 6.6.64 , ≤ 6.6.* (semver)
Unaffected: 6.11.11 , ≤ 6.11.* (semver)
Unaffected: 6.12.2 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:52:22.943Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/include/asm/fadump.h",
            "arch/powerpc/kernel/fadump.c",
            "arch/powerpc/kernel/setup-common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aabef6301dcf410dfd2b8759cd413b2a003c7e3f",
              "status": "affected",
              "version": "11ac3e87ce09c27f4587a8c4fe0829d814021a82",
              "versionType": "git"
            },
            {
              "lessThan": "c5c1d1ef70834013fc3bd12b6a0f4664c6d75a74",
              "status": "affected",
              "version": "11ac3e87ce09c27f4587a8c4fe0829d814021a82",
              "versionType": "git"
            },
            {
              "lessThan": "f551637fe9bf863386309e03f9d148d97f535ad1",
              "status": "affected",
              "version": "11ac3e87ce09c27f4587a8c4fe0829d814021a82",
              "versionType": "git"
            },
            {
              "lessThan": "7351c5a6507b4401aeecadb5959131410a339520",
              "status": "affected",
              "version": "11ac3e87ce09c27f4587a8c4fe0829d814021a82",
              "versionType": "git"
            },
            {
              "lessThan": "05b94cae1c47f94588c3e7096963c1007c4d9c1d",
              "status": "affected",
              "version": "11ac3e87ce09c27f4587a8c4fe0829d814021a82",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/include/asm/fadump.h",
            "arch/powerpc/kernel/fadump.c",
            "arch/powerpc/kernel/setup-common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.64",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()\n\nDuring early init CMA_MIN_ALIGNMENT_BYTES can be PAGE_SIZE,\nsince pageblock_order is still zero and it gets initialized\nlater during initmem_init() e.g.\nsetup_arch() -\u003e initmem_init() -\u003e sparse_init() -\u003e set_pageblock_order()\n\nOne such use case where this causes issue is -\nearly_setup() -\u003e early_init_devtree() -\u003e fadump_reserve_mem() -\u003e fadump_cma_init()\n\nThis causes CMA memory alignment check to be bypassed in\ncma_init_reserved_mem(). Then later cma_activate_area() can hit\na VM_BUG_ON_PAGE(pfn \u0026 ((1 \u003c\u003c order) - 1)) if the reserved memory\narea was not pageblock_order aligned.\n\nFix it by moving the fadump_cma_init() after initmem_init(),\nwhere other such cma reservations also gets called.\n\n\u003cstack trace\u003e\n==============\npage: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10010\nflags: 0x13ffff800000000(node=1|zone=0|lastcpupid=0x7ffff) CMA\nraw: 013ffff800000000 5deadbeef0000100 5deadbeef0000122 0000000000000000\nraw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\npage dumped because: VM_BUG_ON_PAGE(pfn \u0026 ((1 \u003c\u003c order) - 1))\n------------[ cut here ]------------\nkernel BUG at mm/page_alloc.c:778!\n\nCall Trace:\n__free_one_page+0x57c/0x7b0 (unreliable)\nfree_pcppages_bulk+0x1a8/0x2c8\nfree_unref_page_commit+0x3d4/0x4e4\nfree_unref_page+0x458/0x6d0\ninit_cma_reserved_pageblock+0x114/0x198\ncma_init_reserved_areas+0x270/0x3e0\ndo_one_initcall+0x80/0x2f8\nkernel_init_freeable+0x33c/0x530\nkernel_init+0x34/0x26c\nret_from_kernel_user_thread+0x14/0x1c"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is `early_setup() \u2192 early_init_devtree() \u2192 fadump_reserve_mem() \u2192 fadump_cma_init()` and the `core_initcall` CMA activation, both executing during arch boot with no network- or peer-supplied data anywhere along the way. Reaching the affected system requires local presence on a POWER machine at best.\nAC:L - On an affected ppc64 system with FA_DUMP+CMA and fadump enabled, the misalignment is deterministic \u2014 `pageblock_order` is provably zero at that point in boot, so the alignment checks in both `fadump_cma_init()` and `cma_init_reserved_mem()` are unconditionally bypassed. There is no race to win and no memory layout to groom; the failure reproduces on every boot.\nPR:L - No credentials are consumed anywhere on the path \u2014 the misaligned CMA registration and its activation happen autonomously during kernel init, before any userspace process exists to hold privileges. Scoring the highest defensible option, an unprivileged local context is assumed rather than requiring init-namespace root.\nUI:N - The corruption and the resulting BUG occur during kernel initialization at `core_initcall` time; no victim has to mount, open, or otherwise interact with anything.\nS:U - The mis-registered CMA area and the buddy-allocator damage are confined to the kernel\u0027s own memory-management authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - On production kernels (`CONFIG_DEBUG_VM=n`, the default) the `VM_BUG_ON_PAGE` is compiled out and `init_cma_reserved_pageblock()` releases pages past the CMA range end \u2014 fadump metadata/CPU-state/HPTE memory still registered with firmware \u2014 into the general buddy allocator, while misaligned entries in `free_area[pageblock_order]` let `__find_buddy_pfn()` coalesce overlapping blocks so the same physical pages are handed to multiple owners. That aliasing exposes kernel and unrelated-process memory contents to whoever receives the reused pages.\nI:H - The same misaligned free corrupts page-allocator state: `set_pageblock_migratetype()` mislabels a neighbouring pageblock, `__ClearPageReserved()` un-reserves memory the firmware still owns, and overlapping buddy blocks allow one allocation to write over another\u0027s live data. This is memory corruption of allocator metadata and of concurrently-owned pages, leveragable for arbitrary kernel memory modification.\nA:H - With `CONFIG_DEBUG_VM=y` the path hits `VM_BUG_ON_PAGE(pfn \u0026 ((1 \u003c\u003c order) - 1))` \u2192 `kernel BUG at mm/page_alloc.c:778` during `cma_init_reserved_areas()`, panicking the kernel and leaving the machine unbootable. Without DEBUG_VM the resulting buddy-allocator inconsistency produces crashes and corruption later at runtime."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:01.649Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aabef6301dcf410dfd2b8759cd413b2a003c7e3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5c1d1ef70834013fc3bd12b6a0f4664c6d75a74"
        },
        {
          "url": "https://git.kernel.org/stable/c/f551637fe9bf863386309e03f9d148d97f535ad1"
        },
        {
          "url": "https://git.kernel.org/stable/c/7351c5a6507b4401aeecadb5959131410a339520"
        },
        {
          "url": "https://git.kernel.org/stable/c/05b94cae1c47f94588c3e7096963c1007c4d9c1d"
        }
      ],
      "title": "powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56677",
    "datePublished": "2024-12-28T09:46:06.497Z",
    "dateReserved": "2024-12-27T15:00:39.845Z",
    "dateUpdated": "2026-08-05T11:46:01.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56677",
      "date": "2026-08-16",
      "epss": "0.00278",
      "percentile": "0.20357"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()\\n\\nDuring early init CMA_MIN_ALIGNMENT_BYTES can be PAGE_SIZE,\\nsince pageblock_order is still zero and it gets initialized\\nlater during initmem_init() e.g.\\nsetup_arch() -\u003e initmem_init() -\u003e sparse_init() -\u003e set_pageblock_order()\\n\\nOne such use case where this causes issue is -\\nearly_setup() -\u003e early_init_devtree() -\u003e fadump_reserve_mem() -\u003e fadump_cma_init()\\n\\nThis causes CMA memory alignment check to be bypassed in\\ncma_init_reserved_mem(). Then later cma_activate_area() can hit\\na VM_BUG_ON_PAGE(pfn \u0026 ((1 \u003c\u003c order) - 1)) if the reserved memory\\narea was not pageblock_order aligned.\\n\\nFix it by moving the fadump_cma_init() after initmem_init(),\\nwhere other such cma reservations also gets called.\\n\\n\u003cstack trace\u003e\\n==============\\npage: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10010\\nflags: 0x13ffff800000000(node=1|zone=0|lastcpupid=0x7ffff) CMA\\nraw: 013ffff800000000 5deadbeef0000100 5deadbeef0000122 0000000000000000\\nraw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\\npage dumped because: VM_BUG_ON_PAGE(pfn \u0026 ((1 \u003c\u003c order) - 1))\\n------------[ cut here ]------------\\nkernel BUG at mm/page_alloc.c:778!\\n\\nCall Trace:\\n__free_one_page+0x57c/0x7b0 (unreliable)\\nfree_pcppages_bulk+0x1a8/0x2c8\\nfree_unref_page_commit+0x3d4/0x4e4\\nfree_unref_page+0x458/0x6d0\\ninit_cma_reserved_pageblock+0x114/0x198\\ncma_init_reserved_areas+0x270/0x3e0\\ndo_one_initcall+0x80/0x2f8\\nkernel_init_freeable+0x33c/0x530\\nkernel_init+0x34/0x26c\\nret_from_kernel_user_thread+0x14/0x1c\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: powerpc/fadump: mover fadump_cma_init a setup_arch() despu\\u00e9s de initmem_init() Durante la inicializaci\\u00f3n temprana, CMA_MIN_ALIGNMENT_BYTES puede ser PAGE_SIZE, ya que pageblock_order sigue siendo cero y se inicializa m\\u00e1s tarde durante initmem_init(), por ejemplo, setup_arch() -\u0026gt; initmem_init() -\u0026gt; sparse_init() -\u0026gt; set_pageblock_order() Un caso de uso en el que esto causa problemas es: early_setup() -\u0026gt; early_init_devtree() -\u0026gt; fadump_reserve_mem() -\u0026gt; fadump_cma_init() Esto hace que la verificaci\\u00f3n de alineaci\\u00f3n de memoria de CMA se omita en cma_init_reserved_mem(). Luego, m\\u00e1s adelante, cma_activate_area() puede generar un error VM_BUG_ON_PAGE(pfn \u0026amp; ((1 \u0026lt;\u0026lt; order) - 1)) si el \\u00e1rea de memoria reservada no estaba alineada con pageblock_order. Solucione este problema moviendo fadump_cma_init() despu\\u00e9s de initmem_init(), donde tambi\\u00e9n se invocan otras reservas de cma similares.  ============== p\\u00e1gina: refcount:0 mapcount:0 mapping:0000000000000000 \\u00edndice:0x0 pfn:0x10010 indicadores: 0x13ffff800000000(nodo=1|zona=0|lastcpupid=0x7ffff) CMA sin procesar: 013ffff800000000 5deadbeef0000100 5deadbeef0000122 000000000000000 sin procesar: 000000000000000 00000000000000 000000000000 00000000ffffffff 0000000000000000 p\\u00e1gina volcada porque: VM_BUG_ON_PAGE(pfn \u0026amp; ((1 \u0026lt;\u0026lt; orden) - 1)) ------------[ cortar aqu\\u00ed ]------------ \\u00a1ERROR del kernel en mm/page_alloc.c:778! Seguimiento de llamadas: __free_one_page+0x57c/0x7b0 (no confiable) free_pcppages_bulk+0x1a8/0x2c8 free_unref_page_commit+0x3d4/0x4e4 free_unref_page+0x458/0x6d0 init_cma_reserved_pageblock+0x114/0x198 cma_init_reserved_areas+0x270/0x3e0 do_one_initcall+0x80/0x2f8 kernel_init_freeable+0x33c/0x530 kernel_init+0x34/0x26c ret_from_kernel_user_thread+0x14/0x1c\"}]",
      "id": "CVE-2024-56677",
      "lastModified": "2024-12-28T10:15:08.277",
      "published": "2024-12-28T10:15:08.277",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/05b94cae1c47f94588c3e7096963c1007c4d9c1d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/7351c5a6507b4401aeecadb5959131410a339520\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/aabef6301dcf410dfd2b8759cd413b2a003c7e3f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c5c1d1ef70834013fc3bd12b6a0f4664c6d75a74\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f551637fe9bf863386309e03f9d148d97f535ad1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56677\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-28T10:15:08.277\",\"lastModified\":\"2026-08-04T11:22:20.797\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()\\n\\nDuring early init CMA_MIN_ALIGNMENT_BYTES can be PAGE_SIZE,\\nsince pageblock_order is still zero and it gets initialized\\nlater during initmem_init() e.g.\\nsetup_arch() -\u003e initmem_init() -\u003e sparse_init() -\u003e set_pageblock_order()\\n\\nOne such use case where this causes issue is -\\nearly_setup() -\u003e early_init_devtree() -\u003e fadump_reserve_mem() -\u003e fadump_cma_init()\\n\\nThis causes CMA memory alignment check to be bypassed in\\ncma_init_reserved_mem(). Then later cma_activate_area() can hit\\na VM_BUG_ON_PAGE(pfn \u0026 ((1 \u003c\u003c order) - 1)) if the reserved memory\\narea was not pageblock_order aligned.\\n\\nFix it by moving the fadump_cma_init() after initmem_init(),\\nwhere other such cma reservations also gets called.\\n\\n\u003cstack trace\u003e\\n==============\\npage: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10010\\nflags: 0x13ffff800000000(node=1|zone=0|lastcpupid=0x7ffff) CMA\\nraw: 013ffff800000000 5deadbeef0000100 5deadbeef0000122 0000000000000000\\nraw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\\npage dumped because: VM_BUG_ON_PAGE(pfn \u0026 ((1 \u003c\u003c order) - 1))\\n------------[ cut here ]------------\\nkernel BUG at mm/page_alloc.c:778!\\n\\nCall Trace:\\n__free_one_page+0x57c/0x7b0 (unreliable)\\nfree_pcppages_bulk+0x1a8/0x2c8\\nfree_unref_page_commit+0x3d4/0x4e4\\nfree_unref_page+0x458/0x6d0\\ninit_cma_reserved_pageblock+0x114/0x198\\ncma_init_reserved_areas+0x270/0x3e0\\ndo_one_initcall+0x80/0x2f8\\nkernel_init_freeable+0x33c/0x530\\nkernel_init+0x34/0x26c\\nret_from_kernel_user_thread+0x14/0x1c\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: powerpc/fadump: mover fadump_cma_init a setup_arch() despu\u00e9s de initmem_init() Durante la inicializaci\u00f3n temprana, CMA_MIN_ALIGNMENT_BYTES puede ser PAGE_SIZE, ya que pageblock_order sigue siendo cero y se inicializa m\u00e1s tarde durante initmem_init(), por ejemplo, setup_arch() -\u0026gt; initmem_init() -\u0026gt; sparse_init() -\u0026gt; set_pageblock_order() Un caso de uso en el que esto causa problemas es: early_setup() -\u0026gt; early_init_devtree() -\u0026gt; fadump_reserve_mem() -\u0026gt; fadump_cma_init() Esto hace que la verificaci\u00f3n de alineaci\u00f3n de memoria de CMA se omita en cma_init_reserved_mem(). Luego, m\u00e1s adelante, cma_activate_area() puede generar un error VM_BUG_ON_PAGE(pfn \u0026amp; ((1 \u0026lt;\u0026lt; order) - 1)) si el \u00e1rea de memoria reservada no estaba alineada con pageblock_order. Solucione este problema moviendo fadump_cma_init() despu\u00e9s de initmem_init(), donde tambi\u00e9n se invocan otras reservas de cma similares.  ============== p\u00e1gina: refcount:0 mapcount:0 mapping:0000000000000000 \u00edndice:0x0 pfn:0x10010 indicadores: 0x13ffff800000000(nodo=1|zona=0|lastcpupid=0x7ffff) CMA sin procesar: 013ffff800000000 5deadbeef0000100 5deadbeef0000122 000000000000000 sin procesar: 000000000000000 00000000000000 000000000000 00000000ffffffff 0000000000000000 p\u00e1gina volcada porque: VM_BUG_ON_PAGE(pfn \u0026amp; ((1 \u0026lt;\u0026lt; orden) - 1)) ------------[ cortar aqu\u00ed ]------------ \u00a1ERROR del kernel en mm/page_alloc.c:778! Seguimiento de llamadas: __free_one_page+0x57c/0x7b0 (no confiable) free_pcppages_bulk+0x1a8/0x2c8 free_unref_page_commit+0x3d4/0x4e4 free_unref_page+0x458/0x6d0 init_cma_reserved_pageblock+0x114/0x198 cma_init_reserved_areas+0x270/0x3e0 do_one_initcall+0x80/0x2f8 kernel_init_freeable+0x33c/0x530 kernel_init+0x34/0x26c ret_from_kernel_user_thread+0x14/0x1c\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/powerpc/include/asm/fadump.h\",\"arch/powerpc/kernel/fadump.c\",\"arch/powerpc/kernel/setup-common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"11ac3e87ce09c27f4587a8c4fe0829d814021a82\",\"lessThan\":\"aabef6301dcf410dfd2b8759cd413b2a003c7e3f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"11ac3e87ce09c27f4587a8c4fe0829d814021a82\",\"lessThan\":\"c5c1d1ef70834013fc3bd12b6a0f4664c6d75a74\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"11ac3e87ce09c27f4587a8c4fe0829d814021a82\",\"lessThan\":\"f551637fe9bf863386309e03f9d148d97f535ad1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"11ac3e87ce09c27f4587a8c4fe0829d814021a82\",\"lessThan\":\"7351c5a6507b4401aeecadb5959131410a339520\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"11ac3e87ce09c27f4587a8c4fe0829d814021a82\",\"lessThan\":\"05b94cae1c47f94588c3e7096963c1007c4d9c1d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/powerpc/include/asm/fadump.h\",\"arch/powerpc/kernel/fadump.c\",\"arch/powerpc/kernel/setup-common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.120\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.64\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.11\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.2\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19\",\"versionEndExcluding\":\"6.1.120\",\"matchCriteriaId\":\"96FDD29E-2D1D-4602-885E-33F1A42B1BB0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.64\",\"matchCriteriaId\":\"CA16DEE3-ABEC-4449-9F4A-7A3DC4FC36C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.11\",\"matchCriteriaId\":\"21434379-192D-472F-9B54-D45E3650E893\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.2\",\"matchCriteriaId\":\"D8882B1B-2ABC-4838-AC1D-DBDBB5764776\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/05b94cae1c47f94588c3e7096963c1007c4d9c1d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7351c5a6507b4401aeecadb5959131410a339520\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aabef6301dcf410dfd2b8759cd413b2a003c7e3f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c5c1d1ef70834013fc3bd12b6a0f4664c6d75a74\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f551637fe9bf863386309e03f9d148d97f535ad1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:03:09+00:00",
      "cve": "CVE-2024-56677",
      "id": "CVE-2024-56677",
      "initial_release_date": "2024-12-28T00:00:00+00:00",
      "product_status:known_affected": "150",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56677.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:17:06Z",
      "cve": "CVE-2024-56677",
      "id": "CVE-2024-56677",
      "initial_release_date": "2024-12-29T03:48:28Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "365",
      "product_status:recommended": "363",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-56677",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56677.json",
      "version": "57"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.