cve-2024-49878
Vulnerability from cvelistv5
Published
2024-10-21 18:01
Modified
2024-12-19 09:28
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: resource: fix region_intersects() vs add_memory_driver_managed() On a system with CXL memory, the resource tree (/proc/iomem) related to CXL memory may look like something as follows. 490000000-50fffffff : CXL Window 0 490000000-50fffffff : region0 490000000-50fffffff : dax0.0 490000000-50fffffff : System RAM (kmem) Because drivers/dax/kmem.c calls add_memory_driver_managed() during onlining CXL memory, which makes "System RAM (kmem)" a descendant of "CXL Window X". This confuses region_intersects(), which expects all "System RAM" resources to be at the top level of iomem_resource. This can lead to bugs. For example, when the following command line is executed to write some memory in CXL memory range via /dev/mem, $ dd if=data of=/dev/mem bs=$((1 << 10)) seek=$((0x490000000 >> 10)) count=1 dd: error writing '/dev/mem': Bad address 1+0 records in 0+0 records out 0 bytes copied, 0.0283507 s, 0.0 kB/s the command fails as expected. However, the error code is wrong. It should be "Operation not permitted" instead of "Bad address". More seriously, the /dev/mem permission checking in devmem_is_allowed() passes incorrectly. Although the accessing is prevented later because ioremap() isn't allowed to map system RAM, it is a potential security issue. During command executing, the following warning is reported in the kernel log for calling ioremap() on system RAM. ioremap on RAM at 0x0000000490000000 - 0x0000000490000fff WARNING: CPU: 2 PID: 416 at arch/x86/mm/ioremap.c:216 __ioremap_caller.constprop.0+0x131/0x35d Call Trace: memremap+0xcb/0x184 xlate_dev_mem_ptr+0x25/0x2f write_mem+0x94/0xfb vfs_write+0x128/0x26d ksys_write+0xac/0xfe do_syscall_64+0x9a/0xfd entry_SYSCALL_64_after_hwframe+0x4b/0x53 The details of command execution process are as follows. In the above resource tree, "System RAM" is a descendant of "CXL Window 0" instead of a top level resource. So, region_intersects() will report no System RAM resources in the CXL memory region incorrectly, because it only checks the top level resources. Consequently, devmem_is_allowed() will return 1 (allow access via /dev/mem) for CXL memory region incorrectly. Fortunately, ioremap() doesn't allow to map System RAM and reject the access. So, region_intersects() needs to be fixed to work correctly with the resource tree with "System RAM" not at top level as above. To fix it, if we found a unmatched resource in the top level, we will continue to search matched resources in its descendant resources. So, we will not miss any matched resources in resource tree anymore. In the new implementation, an example resource tree |------------- "CXL Window 0" ------------| |-- "System RAM" --| will behave similar as the following fake resource tree for region_intersects(, IORESOURCE_SYSTEM_RAM, ), |-- "System RAM" --||-- "CXL Window 0a" --| Where "CXL Window 0a" is part of the original "CXL Window 0" that isn't covered by "System RAM".
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/06ff97a20b8c9e9d256b0d2c3e87f78f8ccea3dePatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1d5f85f1b7db79c75c9e07d6571ce2a7bdf725c4Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/333fbaf6864a4ca031367eb947961a1f3484d337Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/393331e16ce205e036e58b3d8ca4ee2e635f21d9Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4b90d2eb451b357681063ba4552b10b39d7ad885Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8a6fef7d22a1d952aed68584d3fcc0d018d2bdc3Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/927abc5b7d6d2c2e936bec5a2f71d9512c5e72f7Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b4afe4183ec77f230851ea139d91e5cf2644c68bPatch
Impacted products
Vendor Product Version
Linux Linux Version: c221c0b0308fd01d9fb33a16f64d2fd95f8830a4
Version: c221c0b0308fd01d9fb33a16f64d2fd95f8830a4
Version: c221c0b0308fd01d9fb33a16f64d2fd95f8830a4
Version: c221c0b0308fd01d9fb33a16f64d2fd95f8830a4
Version: c221c0b0308fd01d9fb33a16f64d2fd95f8830a4
Version: c221c0b0308fd01d9fb33a16f64d2fd95f8830a4
Version: c221c0b0308fd01d9fb33a16f64d2fd95f8830a4
Version: c221c0b0308fd01d9fb33a16f64d2fd95f8830a4
 Create a notification for this product.
   Linux Linux Version: 5.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49878",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:46:02.318749Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:48:50.934Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "333fbaf6864a4ca031367eb947961a1f3484d337",
              "status": "affected",
              "version": "c221c0b0308fd01d9fb33a16f64d2fd95f8830a4",
              "versionType": "git"
            },
            {
              "lessThan": "1d5f85f1b7db79c75c9e07d6571ce2a7bdf725c4",
              "status": "affected",
              "version": "c221c0b0308fd01d9fb33a16f64d2fd95f8830a4",
              "versionType": "git"
            },
            {
              "lessThan": "8a6fef7d22a1d952aed68584d3fcc0d018d2bdc3",
              "status": "affected",
              "version": "c221c0b0308fd01d9fb33a16f64d2fd95f8830a4",
              "versionType": "git"
            },
            {
              "lessThan": "4b90d2eb451b357681063ba4552b10b39d7ad885",
              "status": "affected",
              "version": "c221c0b0308fd01d9fb33a16f64d2fd95f8830a4",
              "versionType": "git"
            },
            {
              "lessThan": "393331e16ce205e036e58b3d8ca4ee2e635f21d9",
              "status": "affected",
              "version": "c221c0b0308fd01d9fb33a16f64d2fd95f8830a4",
              "versionType": "git"
            },
            {
              "lessThan": "06ff97a20b8c9e9d256b0d2c3e87f78f8ccea3de",
              "status": "affected",
              "version": "c221c0b0308fd01d9fb33a16f64d2fd95f8830a4",
              "versionType": "git"
            },
            {
              "lessThan": "927abc5b7d6d2c2e936bec5a2f71d9512c5e72f7",
              "status": "affected",
              "version": "c221c0b0308fd01d9fb33a16f64d2fd95f8830a4",
              "versionType": "git"
            },
            {
              "lessThan": "b4afe4183ec77f230851ea139d91e5cf2644c68b",
              "status": "affected",
              "version": "c221c0b0308fd01d9fb33a16f64d2fd95f8830a4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nresource: fix region_intersects() vs add_memory_driver_managed()\n\nOn a system with CXL memory, the resource tree (/proc/iomem) related to\nCXL memory may look like something as follows.\n\n490000000-50fffffff : CXL Window 0\n  490000000-50fffffff : region0\n    490000000-50fffffff : dax0.0\n      490000000-50fffffff : System RAM (kmem)\n\nBecause drivers/dax/kmem.c calls add_memory_driver_managed() during\nonlining CXL memory, which makes \"System RAM (kmem)\" a descendant of \"CXL\nWindow X\".  This confuses region_intersects(), which expects all \"System\nRAM\" resources to be at the top level of iomem_resource.  This can lead to\nbugs.\n\nFor example, when the following command line is executed to write some\nmemory in CXL memory range via /dev/mem,\n\n $ dd if=data of=/dev/mem bs=$((1 \u003c\u003c 10)) seek=$((0x490000000 \u003e\u003e 10)) count=1\n dd: error writing \u0027/dev/mem\u0027: Bad address\n 1+0 records in\n 0+0 records out\n 0 bytes copied, 0.0283507 s, 0.0 kB/s\n\nthe command fails as expected.  However, the error code is wrong.  It\nshould be \"Operation not permitted\" instead of \"Bad address\".  More\nseriously, the /dev/mem permission checking in devmem_is_allowed() passes\nincorrectly.  Although the accessing is prevented later because ioremap()\nisn\u0027t allowed to map system RAM, it is a potential security issue.  During\ncommand executing, the following warning is reported in the kernel log for\ncalling ioremap() on system RAM.\n\n ioremap on RAM at 0x0000000490000000 - 0x0000000490000fff\n WARNING: CPU: 2 PID: 416 at arch/x86/mm/ioremap.c:216 __ioremap_caller.constprop.0+0x131/0x35d\n Call Trace:\n  memremap+0xcb/0x184\n  xlate_dev_mem_ptr+0x25/0x2f\n  write_mem+0x94/0xfb\n  vfs_write+0x128/0x26d\n  ksys_write+0xac/0xfe\n  do_syscall_64+0x9a/0xfd\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nThe details of command execution process are as follows.  In the above\nresource tree, \"System RAM\" is a descendant of \"CXL Window 0\" instead of a\ntop level resource.  So, region_intersects() will report no System RAM\nresources in the CXL memory region incorrectly, because it only checks the\ntop level resources.  Consequently, devmem_is_allowed() will return 1\n(allow access via /dev/mem) for CXL memory region incorrectly. \nFortunately, ioremap() doesn\u0027t allow to map System RAM and reject the\naccess.\n\nSo, region_intersects() needs to be fixed to work correctly with the\nresource tree with \"System RAM\" not at top level as above.  To fix it, if\nwe found a unmatched resource in the top level, we will continue to search\nmatched resources in its descendant resources.  So, we will not miss any\nmatched resources in resource tree anymore.\n\nIn the new implementation, an example resource tree\n\n|------------- \"CXL Window 0\" ------------|\n|-- \"System RAM\" --|\n\nwill behave similar as the following fake resource tree for\nregion_intersects(, IORESOURCE_SYSTEM_RAM, ),\n\n|-- \"System RAM\" --||-- \"CXL Window 0a\" --|\n\nWhere \"CXL Window 0a\" is part of the original \"CXL Window 0\" that\nisn\u0027t covered by \"System RAM\"."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:28:12.751Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/333fbaf6864a4ca031367eb947961a1f3484d337"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d5f85f1b7db79c75c9e07d6571ce2a7bdf725c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a6fef7d22a1d952aed68584d3fcc0d018d2bdc3"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b90d2eb451b357681063ba4552b10b39d7ad885"
        },
        {
          "url": "https://git.kernel.org/stable/c/393331e16ce205e036e58b3d8ca4ee2e635f21d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/06ff97a20b8c9e9d256b0d2c3e87f78f8ccea3de"
        },
        {
          "url": "https://git.kernel.org/stable/c/927abc5b7d6d2c2e936bec5a2f71d9512c5e72f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4afe4183ec77f230851ea139d91e5cf2644c68b"
        }
      ],
      "title": "resource: fix region_intersects() vs add_memory_driver_managed()",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49878",
    "datePublished": "2024-10-21T18:01:17.468Z",
    "dateReserved": "2024-10-21T12:17:06.021Z",
    "dateUpdated": "2024-12-19T09:28:12.751Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49878\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T18:15:09.863\",\"lastModified\":\"2024-11-13T14:32:13.227\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nresource: fix region_intersects() vs add_memory_driver_managed()\\n\\nOn a system with CXL memory, the resource tree (/proc/iomem) related to\\nCXL memory may look like something as follows.\\n\\n490000000-50fffffff : CXL Window 0\\n  490000000-50fffffff : region0\\n    490000000-50fffffff : dax0.0\\n      490000000-50fffffff : System RAM (kmem)\\n\\nBecause drivers/dax/kmem.c calls add_memory_driver_managed() during\\nonlining CXL memory, which makes \\\"System RAM (kmem)\\\" a descendant of \\\"CXL\\nWindow X\\\".  This confuses region_intersects(), which expects all \\\"System\\nRAM\\\" resources to be at the top level of iomem_resource.  This can lead to\\nbugs.\\n\\nFor example, when the following command line is executed to write some\\nmemory in CXL memory range via /dev/mem,\\n\\n $ dd if=data of=/dev/mem bs=$((1 \u003c\u003c 10)) seek=$((0x490000000 \u003e\u003e 10)) count=1\\n dd: error writing \u0027/dev/mem\u0027: Bad address\\n 1+0 records in\\n 0+0 records out\\n 0 bytes copied, 0.0283507 s, 0.0 kB/s\\n\\nthe command fails as expected.  However, the error code is wrong.  It\\nshould be \\\"Operation not permitted\\\" instead of \\\"Bad address\\\".  More\\nseriously, the /dev/mem permission checking in devmem_is_allowed() passes\\nincorrectly.  Although the accessing is prevented later because ioremap()\\nisn\u0027t allowed to map system RAM, it is a potential security issue.  During\\ncommand executing, the following warning is reported in the kernel log for\\ncalling ioremap() on system RAM.\\n\\n ioremap on RAM at 0x0000000490000000 - 0x0000000490000fff\\n WARNING: CPU: 2 PID: 416 at arch/x86/mm/ioremap.c:216 __ioremap_caller.constprop.0+0x131/0x35d\\n Call Trace:\\n  memremap+0xcb/0x184\\n  xlate_dev_mem_ptr+0x25/0x2f\\n  write_mem+0x94/0xfb\\n  vfs_write+0x128/0x26d\\n  ksys_write+0xac/0xfe\\n  do_syscall_64+0x9a/0xfd\\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n\\nThe details of command execution process are as follows.  In the above\\nresource tree, \\\"System RAM\\\" is a descendant of \\\"CXL Window 0\\\" instead of a\\ntop level resource.  So, region_intersects() will report no System RAM\\nresources in the CXL memory region incorrectly, because it only checks the\\ntop level resources.  Consequently, devmem_is_allowed() will return 1\\n(allow access via /dev/mem) for CXL memory region incorrectly. \\nFortunately, ioremap() doesn\u0027t allow to map System RAM and reject the\\naccess.\\n\\nSo, region_intersects() needs to be fixed to work correctly with the\\nresource tree with \\\"System RAM\\\" not at top level as above.  To fix it, if\\nwe found a unmatched resource in the top level, we will continue to search\\nmatched resources in its descendant resources.  So, we will not miss any\\nmatched resources in resource tree anymore.\\n\\nIn the new implementation, an example resource tree\\n\\n|------------- \\\"CXL Window 0\\\" ------------|\\n|-- \\\"System RAM\\\" --|\\n\\nwill behave similar as the following fake resource tree for\\nregion_intersects(, IORESOURCE_SYSTEM_RAM, ),\\n\\n|-- \\\"System RAM\\\" --||-- \\\"CXL Window 0a\\\" --|\\n\\nWhere \\\"CXL Window 0a\\\" is part of the original \\\"CXL Window 0\\\" that\\nisn\u0027t covered by \\\"System RAM\\\".\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: recurso: corregir region_intersects() frente a add_memory_driver_managed() En un sistema con memoria CXL, el \u00e1rbol de recursos (/proc/iomem) relacionado con la memoria CXL puede parecerse a lo siguiente. 490000000-50fffffff: CXL Window 0 490000000-50fffffff: region0 490000000-50fffffff: dax0.0 490000000-50fffffff: RAM del sistema (kmem) Debido a que drivers/dax/kmem.c llama a add_memory_driver_managed() durante la conexi\u00f3n en l\u00ednea de la memoria CXL, lo que hace que \\\"System RAM (kmem)\\\" sea un descendiente de \\\"CXL Window X\\\". Esto confunde a region_intersects(), que espera que todos los recursos de \\\"RAM del sistema\\\" est\u00e9n en el nivel superior de iomem_resource. Esto puede provocar errores. Por ejemplo, cuando se ejecuta la siguiente l\u00ednea de comando para escribir algo de memoria en el rango de memoria CXL a trav\u00e9s de /dev/mem, $ dd if=data of=/dev/mem bs=$((1 \u0026lt;\u0026lt; 10)) seek=$((0x490000000 \u0026gt;\u0026gt; 10)) count=1 dd: error writing \u0027/dev/mem\u0027: Bad address 1+0 records in 0+0 records out 0 bytes copies, 0.0283507 s, 0.0 kB/s el comando falla como se esperaba. Sin embargo, el c\u00f3digo de error es incorrecto. Deber\u00eda ser \\\"Operaci\u00f3n no permitida\\\" en lugar de \\\"Direcci\u00f3n incorrecta\\\". M\u00e1s grave a\u00fan, la comprobaci\u00f3n de permisos de /dev/mem en devmem_is_allowed() pasa incorrectamente. Aunque el acceso se impide m\u00e1s tarde porque ioremap() no tiene permiso para mapear la RAM del sistema, es un problema de seguridad potencial. Durante la ejecuci\u00f3n del comando, se informa la siguiente advertencia en el registro del n\u00facleo por llamar a ioremap() en la RAM del sistema. ioremap en RAM en 0x0000000490000000 - 0x0000000490000fff ADVERTENCIA: CPU: 2 PID: 416 en arch/x86/mm/ioremap.c:216 __ioremap_caller.constprop.0+0x131/0x35d Rastreo de llamadas: memremap+0xcb/0x184 xlate_dev_mem_ptr+0x25/0x2f write_mem+0x94/0xfb vfs_write+0x128/0x26d ksys_write+0xac/0xfe do_syscall_64+0x9a/0xfd entry_SYSCALL_64_after_hwframe+0x4b/0x53 Los detalles del proceso de ejecuci\u00f3n del comando son los siguientes. En el \u00e1rbol de recursos anterior, \\\"System RAM\\\" es un descendiente de \\\"CXL Window 0\\\" en lugar de un recurso de nivel superior. Por lo tanto, region_intersects() no informar\u00e1 de forma incorrecta ning\u00fan recurso de System RAM en la regi\u00f3n de memoria CXL, porque solo comprueba los recursos de nivel superior. En consecuencia, devmem_is_allowed() devolver\u00e1 1 (permitir\u00e1 el acceso a trav\u00e9s de /dev/mem) para la regi\u00f3n de memoria CXL de forma incorrecta. Afortunadamente, ioremap() no permite mapear System RAM y rechazar el acceso. Por lo tanto, es necesario corregir region_intersects() para que funcione correctamente con el \u00e1rbol de recursos con \\\"System RAM\\\" no en el nivel superior como se indica anteriormente. Para corregirlo, si encontramos un recurso no coincidente en el nivel superior, continuaremos buscando recursos coincidentes en sus recursos descendientes. Por lo tanto, ya no nos perderemos ning\u00fan recurso coincidente en el \u00e1rbol de recursos. En la nueva implementaci\u00f3n, un \u00e1rbol de recursos de ejemplo |------------- \\\"CXL Window 0\\\" ------------| |-- \\\"System RAM\\\" --| se comportar\u00e1 de manera similar al siguiente \u00e1rbol de recursos falso para region_intersects(, IORESOURCE_SYSTEM_RAM, ), |-- \\\"RAM del sistema\\\" --||-- \\\"Ventana CXL 0a\\\" --| Donde \\\"Ventana CXL 0a\\\" es parte de la \\\"Ventana CXL 0\\\" original que no est\u00e1 cubierta por la \\\"RAM del sistema\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.1\",\"versionEndExcluding\":\"5.10.227\",\"matchCriteriaId\":\"AD732A27-BE8B-4786-B27A-0C7AEF3D4588\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"4D51C05D-455B-4D8D-89E7-A58E140B864C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.55\",\"matchCriteriaId\":\"E90B9576-56C4-47BC-AAB0-C5B2D438F5D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.14\",\"matchCriteriaId\":\"4C16BCE0-FFA0-4599-BE0A-1FD65101C021\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/06ff97a20b8c9e9d256b0d2c3e87f78f8ccea3de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1d5f85f1b7db79c75c9e07d6571ce2a7bdf725c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/333fbaf6864a4ca031367eb947961a1f3484d337\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/393331e16ce205e036e58b3d8ca4ee2e635f21d9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4b90d2eb451b357681063ba4552b10b39d7ad885\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8a6fef7d22a1d952aed68584d3fcc0d018d2bdc3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/927abc5b7d6d2c2e936bec5a2f71d9512c5e72f7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b4afe4183ec77f230851ea139d91e5cf2644c68b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49878\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:46:02.318749Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:46:05.391Z\"}}], \"cna\": {\"title\": \"resource: fix region_intersects() vs add_memory_driver_managed()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c221c0b0308fd01d9fb33a16f64d2fd95f8830a4\", \"lessThan\": \"333fbaf6864a4ca031367eb947961a1f3484d337\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c221c0b0308fd01d9fb33a16f64d2fd95f8830a4\", \"lessThan\": \"1d5f85f1b7db79c75c9e07d6571ce2a7bdf725c4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c221c0b0308fd01d9fb33a16f64d2fd95f8830a4\", \"lessThan\": \"8a6fef7d22a1d952aed68584d3fcc0d018d2bdc3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c221c0b0308fd01d9fb33a16f64d2fd95f8830a4\", \"lessThan\": \"4b90d2eb451b357681063ba4552b10b39d7ad885\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c221c0b0308fd01d9fb33a16f64d2fd95f8830a4\", \"lessThan\": \"393331e16ce205e036e58b3d8ca4ee2e635f21d9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c221c0b0308fd01d9fb33a16f64d2fd95f8830a4\", \"lessThan\": \"06ff97a20b8c9e9d256b0d2c3e87f78f8ccea3de\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c221c0b0308fd01d9fb33a16f64d2fd95f8830a4\", \"lessThan\": \"927abc5b7d6d2c2e936bec5a2f71d9512c5e72f7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c221c0b0308fd01d9fb33a16f64d2fd95f8830a4\", \"lessThan\": \"b4afe4183ec77f230851ea139d91e5cf2644c68b\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/resource.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.1\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.1\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.55\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/resource.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/333fbaf6864a4ca031367eb947961a1f3484d337\"}, {\"url\": \"https://git.kernel.org/stable/c/1d5f85f1b7db79c75c9e07d6571ce2a7bdf725c4\"}, {\"url\": \"https://git.kernel.org/stable/c/8a6fef7d22a1d952aed68584d3fcc0d018d2bdc3\"}, {\"url\": \"https://git.kernel.org/stable/c/4b90d2eb451b357681063ba4552b10b39d7ad885\"}, {\"url\": \"https://git.kernel.org/stable/c/393331e16ce205e036e58b3d8ca4ee2e635f21d9\"}, {\"url\": \"https://git.kernel.org/stable/c/06ff97a20b8c9e9d256b0d2c3e87f78f8ccea3de\"}, {\"url\": \"https://git.kernel.org/stable/c/927abc5b7d6d2c2e936bec5a2f71d9512c5e72f7\"}, {\"url\": \"https://git.kernel.org/stable/c/b4afe4183ec77f230851ea139d91e5cf2644c68b\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nresource: fix region_intersects() vs add_memory_driver_managed()\\n\\nOn a system with CXL memory, the resource tree (/proc/iomem) related to\\nCXL memory may look like something as follows.\\n\\n490000000-50fffffff : CXL Window 0\\n  490000000-50fffffff : region0\\n    490000000-50fffffff : dax0.0\\n      490000000-50fffffff : System RAM (kmem)\\n\\nBecause drivers/dax/kmem.c calls add_memory_driver_managed() during\\nonlining CXL memory, which makes \\\"System RAM (kmem)\\\" a descendant of \\\"CXL\\nWindow X\\\".  This confuses region_intersects(), which expects all \\\"System\\nRAM\\\" resources to be at the top level of iomem_resource.  This can lead to\\nbugs.\\n\\nFor example, when the following command line is executed to write some\\nmemory in CXL memory range via /dev/mem,\\n\\n $ dd if=data of=/dev/mem bs=$((1 \u003c\u003c 10)) seek=$((0x490000000 \u003e\u003e 10)) count=1\\n dd: error writing \u0027/dev/mem\u0027: Bad address\\n 1+0 records in\\n 0+0 records out\\n 0 bytes copied, 0.0283507 s, 0.0 kB/s\\n\\nthe command fails as expected.  However, the error code is wrong.  It\\nshould be \\\"Operation not permitted\\\" instead of \\\"Bad address\\\".  More\\nseriously, the /dev/mem permission checking in devmem_is_allowed() passes\\nincorrectly.  Although the accessing is prevented later because ioremap()\\nisn\u0027t allowed to map system RAM, it is a potential security issue.  During\\ncommand executing, the following warning is reported in the kernel log for\\ncalling ioremap() on system RAM.\\n\\n ioremap on RAM at 0x0000000490000000 - 0x0000000490000fff\\n WARNING: CPU: 2 PID: 416 at arch/x86/mm/ioremap.c:216 __ioremap_caller.constprop.0+0x131/0x35d\\n Call Trace:\\n  memremap+0xcb/0x184\\n  xlate_dev_mem_ptr+0x25/0x2f\\n  write_mem+0x94/0xfb\\n  vfs_write+0x128/0x26d\\n  ksys_write+0xac/0xfe\\n  do_syscall_64+0x9a/0xfd\\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n\\nThe details of command execution process are as follows.  In the above\\nresource tree, \\\"System RAM\\\" is a descendant of \\\"CXL Window 0\\\" instead of a\\ntop level resource.  So, region_intersects() will report no System RAM\\nresources in the CXL memory region incorrectly, because it only checks the\\ntop level resources.  Consequently, devmem_is_allowed() will return 1\\n(allow access via /dev/mem) for CXL memory region incorrectly. \\nFortunately, ioremap() doesn\u0027t allow to map System RAM and reject the\\naccess.\\n\\nSo, region_intersects() needs to be fixed to work correctly with the\\nresource tree with \\\"System RAM\\\" not at top level as above.  To fix it, if\\nwe found a unmatched resource in the top level, we will continue to search\\nmatched resources in its descendant resources.  So, we will not miss any\\nmatched resources in resource tree anymore.\\n\\nIn the new implementation, an example resource tree\\n\\n|------------- \\\"CXL Window 0\\\" ------------|\\n|-- \\\"System RAM\\\" --|\\n\\nwill behave similar as the following fake resource tree for\\nregion_intersects(, IORESOURCE_SYSTEM_RAM, ),\\n\\n|-- \\\"System RAM\\\" --||-- \\\"CXL Window 0a\\\" --|\\n\\nWhere \\\"CXL Window 0a\\\" is part of the original \\\"CXL Window 0\\\" that\\nisn\u0027t covered by \\\"System RAM\\\".\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:28:12.751Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49878\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:28:12.751Z\", \"dateReserved\": \"2024-10-21T12:17:06.021Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:01:17.468Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.