cve-2024-26762
Vulnerability from cvelistv5
Published
2024-04-03 17:00
Modified
2024-12-19 08:46
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: cxl/pci: Skip to handle RAS errors if CXL.mem device is detached The PCI AER model is an awkward fit for CXL error handling. While the expectation is that a PCI device can escalate to link reset to recover from an AER event, the same reset on CXL amounts to a surprise memory hotplug of massive amounts of memory. At present, the CXL error handler attempts some optimistic error handling to unbind the device from the cxl_mem driver after reaping some RAS register values. This results in a "hopeful" attempt to unplug the memory, but there is no guarantee that will succeed. A subsequent AER notification after the memdev unbind event can no longer assume the registers are mapped. Check for memdev bind before reaping status register values to avoid crashes of the form: BUG: unable to handle page fault for address: ffa00000195e9100 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page [...] RIP: 0010:__cxl_handle_ras+0x30/0x110 [cxl_core] [...] Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x82/0x160 ? kernelmode_fixup_or_oops+0x84/0x110 ? exc_page_fault+0x113/0x170 ? asm_exc_page_fault+0x26/0x30 ? __pfx_dpc_reset_link+0x10/0x10 ? __cxl_handle_ras+0x30/0x110 [cxl_core] ? find_cxl_port+0x59/0x80 [cxl_core] cxl_handle_rp_ras+0xbc/0xd0 [cxl_core] cxl_error_detected+0x6c/0xf0 [cxl_core] report_error_detected+0xc7/0x1c0 pci_walk_bus+0x73/0x90 pcie_do_recovery+0x23f/0x330 Longer term, the unbind and PCI_ERS_RESULT_DISCONNECT behavior might need to be replaced with a new PCI_ERS_RESULT_PANIC.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102
Impacted products
Vendor Product Version
Linux Linux Version: 6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab
Version: 6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab
 Create a notification for this product.
   Linux Linux Version: 6.7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26762",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-05T18:38:38.263308Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:49:18.559Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.382Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21e5e84f3f63fdf44e49642a6e45cd895e921a84",
              "status": "affected",
              "version": "6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab",
              "versionType": "git"
            },
            {
              "lessThan": "eef5c7b28dbecd6b141987a96db6c54e49828102",
              "status": "affected",
              "version": "6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/cxl/core/pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/pci: Skip to handle RAS errors if CXL.mem device is detached\n\nThe PCI AER model is an awkward fit for CXL error handling. While the\nexpectation is that a PCI device can escalate to link reset to recover\nfrom an AER event, the same reset on CXL amounts to a surprise memory\nhotplug of massive amounts of memory.\n\nAt present, the CXL error handler attempts some optimistic error\nhandling to unbind the device from the cxl_mem driver after reaping some\nRAS register values. This results in a \"hopeful\" attempt to unplug the\nmemory, but there is no guarantee that will succeed.\n\nA subsequent AER notification after the memdev unbind event can no\nlonger assume the registers are mapped. Check for memdev bind before\nreaping status register values to avoid crashes of the form:\n\n BUG: unable to handle page fault for address: ffa00000195e9100\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n [...]\n RIP: 0010:__cxl_handle_ras+0x30/0x110 [cxl_core]\n [...]\n Call Trace:\n  \u003cTASK\u003e\n  ? __die+0x24/0x70\n  ? page_fault_oops+0x82/0x160\n  ? kernelmode_fixup_or_oops+0x84/0x110\n  ? exc_page_fault+0x113/0x170\n  ? asm_exc_page_fault+0x26/0x30\n  ? __pfx_dpc_reset_link+0x10/0x10\n  ? __cxl_handle_ras+0x30/0x110 [cxl_core]\n  ? find_cxl_port+0x59/0x80 [cxl_core]\n  cxl_handle_rp_ras+0xbc/0xd0 [cxl_core]\n  cxl_error_detected+0x6c/0xf0 [cxl_core]\n  report_error_detected+0xc7/0x1c0\n  pci_walk_bus+0x73/0x90\n  pcie_do_recovery+0x23f/0x330\n\nLonger term, the unbind and PCI_ERS_RESULT_DISCONNECT behavior might\nneed to be replaced with a new PCI_ERS_RESULT_PANIC."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:46:41.478Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84"
        },
        {
          "url": "https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102"
        }
      ],
      "title": "cxl/pci: Skip to handle RAS errors if CXL.mem device is detached",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26762",
    "datePublished": "2024-04-03T17:00:45.655Z",
    "dateReserved": "2024-02-19T14:20:24.172Z",
    "dateUpdated": "2024-12-19T08:46:41.478Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26762\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-03T17:15:52.470\",\"lastModified\":\"2024-11-21T09:03:00.880\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncxl/pci: Skip to handle RAS errors if CXL.mem device is detached\\n\\nThe PCI AER model is an awkward fit for CXL error handling. While the\\nexpectation is that a PCI device can escalate to link reset to recover\\nfrom an AER event, the same reset on CXL amounts to a surprise memory\\nhotplug of massive amounts of memory.\\n\\nAt present, the CXL error handler attempts some optimistic error\\nhandling to unbind the device from the cxl_mem driver after reaping some\\nRAS register values. This results in a \\\"hopeful\\\" attempt to unplug the\\nmemory, but there is no guarantee that will succeed.\\n\\nA subsequent AER notification after the memdev unbind event can no\\nlonger assume the registers are mapped. Check for memdev bind before\\nreaping status register values to avoid crashes of the form:\\n\\n BUG: unable to handle page fault for address: ffa00000195e9100\\n #PF: supervisor read access in kernel mode\\n #PF: error_code(0x0000) - not-present page\\n [...]\\n RIP: 0010:__cxl_handle_ras+0x30/0x110 [cxl_core]\\n [...]\\n Call Trace:\\n  \u003cTASK\u003e\\n  ? __die+0x24/0x70\\n  ? page_fault_oops+0x82/0x160\\n  ? kernelmode_fixup_or_oops+0x84/0x110\\n  ? exc_page_fault+0x113/0x170\\n  ? asm_exc_page_fault+0x26/0x30\\n  ? __pfx_dpc_reset_link+0x10/0x10\\n  ? __cxl_handle_ras+0x30/0x110 [cxl_core]\\n  ? find_cxl_port+0x59/0x80 [cxl_core]\\n  cxl_handle_rp_ras+0xbc/0xd0 [cxl_core]\\n  cxl_error_detected+0x6c/0xf0 [cxl_core]\\n  report_error_detected+0xc7/0x1c0\\n  pci_walk_bus+0x73/0x90\\n  pcie_do_recovery+0x23f/0x330\\n\\nLonger term, the unbind and PCI_ERS_RESULT_DISCONNECT behavior might\\nneed to be replaced with a new PCI_ERS_RESULT_PANIC.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: cxl/pci: omita para manejar errores RAS si el dispositivo CXL.mem est\u00e1 desconectado. El modelo PCI AER no es adecuado para el manejo de errores CXL. Si bien la expectativa es que un dispositivo PCI pueda escalar hasta restablecer el enlace para recuperarse de un evento AER, el mismo restablecimiento en CXL equivale a una conexi\u00f3n en caliente sorpresa de cantidades masivas de memoria. Actualmente, el controlador de errores CXL intenta un manejo optimista de errores para desvincular el dispositivo del controlador cxl_mem despu\u00e9s de obtener algunos valores de registro RAS. Esto da como resultado un intento \\\"esperanzador\\\" de desconectar la memoria, pero no hay garant\u00eda de que tenga \u00e9xito. Una notificaci\u00f3n AER posterior despu\u00e9s del evento de desvinculaci\u00f3n de memdev ya no puede asumir que los registros est\u00e1n asignados. Verifique el enlace de memdev antes de obtener los valores del registro de estado para evitar fallas del tipo: ERROR: no se puede manejar el error de p\u00e1gina para la direcci\u00f3n: ffa00000195e9100 #PF: acceso de lectura del supervisor en modo kernel #PF: c\u00f3digo_error(0x0000) - p\u00e1gina no presente [. ..] RIP: 0010:__cxl_handle_ras+0x30/0x110 [cxl_core] [...] Seguimiento de llamadas: ? __morir+0x24/0x70 ? page_fault_oops+0x82/0x160? kernelmode_fixup_or_oops+0x84/0x110? exc_page_fault+0x113/0x170? asm_exc_page_fault+0x26/0x30? __pfx_dpc_reset_link+0x10/0x10 ? __cxl_handle_ras+0x30/0x110 [cxl_core] ? find_cxl_port+0x59/0x80 [cxl_core] cxl_handle_rp_ras+0xbc/0xd0 [cxl_core] cxl_error_detected+0x6c/0xf0 [cxl_core] report_error_detected+0xc7/0x1c0 pci_walk_bus+0x73/0x90 pcie_do_recovery+0x23f/0x330 A m\u00e1s largo plazo, es posible que sea necesario corregir el comportamiento de desvinculaci\u00f3n y PCI_ERS_RESULT_DISCONNECT. ser reemplazado por un nuevo PCI_ERS_RESULT_PANIC.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.382Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26762\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-05T18:38:38.263308Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:22.318Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"cxl/pci: Skip to handle RAS errors if CXL.mem device is detached\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab\", \"lessThan\": \"21e5e84f3f63fdf44e49642a6e45cd895e921a84\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6ac07883dbb5f60f7bc56a13b7a84a382aa9c1ab\", \"lessThan\": \"eef5c7b28dbecd6b141987a96db6c54e49828102\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/cxl/core/pci.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.7.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/cxl/core/pci.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/21e5e84f3f63fdf44e49642a6e45cd895e921a84\"}, {\"url\": \"https://git.kernel.org/stable/c/eef5c7b28dbecd6b141987a96db6c54e49828102\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncxl/pci: Skip to handle RAS errors if CXL.mem device is detached\\n\\nThe PCI AER model is an awkward fit for CXL error handling. While the\\nexpectation is that a PCI device can escalate to link reset to recover\\nfrom an AER event, the same reset on CXL amounts to a surprise memory\\nhotplug of massive amounts of memory.\\n\\nAt present, the CXL error handler attempts some optimistic error\\nhandling to unbind the device from the cxl_mem driver after reaping some\\nRAS register values. This results in a \\\"hopeful\\\" attempt to unplug the\\nmemory, but there is no guarantee that will succeed.\\n\\nA subsequent AER notification after the memdev unbind event can no\\nlonger assume the registers are mapped. Check for memdev bind before\\nreaping status register values to avoid crashes of the form:\\n\\n BUG: unable to handle page fault for address: ffa00000195e9100\\n #PF: supervisor read access in kernel mode\\n #PF: error_code(0x0000) - not-present page\\n [...]\\n RIP: 0010:__cxl_handle_ras+0x30/0x110 [cxl_core]\\n [...]\\n Call Trace:\\n  \u003cTASK\u003e\\n  ? __die+0x24/0x70\\n  ? page_fault_oops+0x82/0x160\\n  ? kernelmode_fixup_or_oops+0x84/0x110\\n  ? exc_page_fault+0x113/0x170\\n  ? asm_exc_page_fault+0x26/0x30\\n  ? __pfx_dpc_reset_link+0x10/0x10\\n  ? __cxl_handle_ras+0x30/0x110 [cxl_core]\\n  ? find_cxl_port+0x59/0x80 [cxl_core]\\n  cxl_handle_rp_ras+0xbc/0xd0 [cxl_core]\\n  cxl_error_detected+0x6c/0xf0 [cxl_core]\\n  report_error_detected+0xc7/0x1c0\\n  pci_walk_bus+0x73/0x90\\n  pcie_do_recovery+0x23f/0x330\\n\\nLonger term, the unbind and PCI_ERS_RESULT_DISCONNECT behavior might\\nneed to be replaced with a new PCI_ERS_RESULT_PANIC.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T08:46:41.478Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26762\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T08:46:41.478Z\", \"dateReserved\": \"2024-02-19T14:20:24.172Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-03T17:00:45.655Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.