cve-2024-49886
Vulnerability from cvelistv5
Published
2024-10-21 18:01
Modified
2024-12-19 09:28
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug Attaching SST PCI device to VM causes "BUG: KASAN: slab-out-of-bounds". kasan report: [ 19.411889] ================================================================== [ 19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113 [ 19.417368] [ 19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G E 6.9.0 #10 [ 19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022 [ 19.422687] Call Trace: [ 19.424091] <TASK> [ 19.425448] dump_stack_lvl+0x5d/0x80 [ 19.426963] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.428694] print_report+0x19d/0x52e [ 19.430206] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 19.431837] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.433539] kasan_report+0xf0/0x170 [ 19.435019] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.436709] _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.438379] ? __pfx_sched_clock_cpu+0x10/0x10 [ 19.439910] isst_if_cpu_online+0x406/0x58f [isst_if_common] [ 19.441573] ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common] [ 19.443263] ? ttwu_queue_wakelist+0x2c1/0x360 [ 19.444797] cpuhp_invoke_callback+0x221/0xec0 [ 19.446337] cpuhp_thread_fun+0x21b/0x610 [ 19.447814] ? __pfx_cpuhp_thread_fun+0x10/0x10 [ 19.449354] smpboot_thread_fn+0x2e7/0x6e0 [ 19.450859] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 19.452405] kthread+0x29c/0x350 [ 19.453817] ? __pfx_kthread+0x10/0x10 [ 19.455253] ret_from_fork+0x31/0x70 [ 19.456685] ? __pfx_kthread+0x10/0x10 [ 19.458114] ret_from_fork_asm+0x1a/0x30 [ 19.459573] </TASK> [ 19.460853] [ 19.462055] Allocated by task 1198: [ 19.463410] kasan_save_stack+0x30/0x50 [ 19.464788] kasan_save_track+0x14/0x30 [ 19.466139] __kasan_kmalloc+0xaa/0xb0 [ 19.467465] __kmalloc+0x1cd/0x470 [ 19.468748] isst_if_cdev_register+0x1da/0x350 [isst_if_common] [ 19.470233] isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr] [ 19.471670] do_one_initcall+0xa4/0x380 [ 19.472903] do_init_module+0x238/0x760 [ 19.474105] load_module+0x5239/0x6f00 [ 19.475285] init_module_from_file+0xd1/0x130 [ 19.476506] idempotent_init_module+0x23b/0x650 [ 19.477725] __x64_sys_finit_module+0xbe/0x130 [ 19.476506] idempotent_init_module+0x23b/0x650 [ 19.477725] __x64_sys_finit_module+0xbe/0x130 [ 19.478920] do_syscall_64+0x82/0x160 [ 19.480036] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 19.481292] [ 19.482205] The buggy address belongs to the object at ffff888829e65000 which belongs to the cache kmalloc-512 of size 512 [ 19.484818] The buggy address is located 0 bytes to the right of allocated 512-byte region [ffff888829e65000, ffff888829e65200) [ 19.487447] [ 19.488328] The buggy address belongs to the physical page: [ 19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60 [ 19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff) [ 19.493914] page_type: 0xffffffff() [ 19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001 [ 19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000 [ 19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001 [ 19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000 [ 19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff [ 19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000 [ 19.503784] page dumped because: k ---truncated---
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1973c4d8ee0782a808303d75e3be9c12baaacd97Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7d59ac07ccb58f8f604f8057db63b8efcebeb3dePatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8176d4878ed2af5d93ddd0e971e24c412124d38bPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/afa7f78d9a907cfded6c98c91aae2bf7b3b56e51Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cdd03afcb6eda3103da5a0948d3db12372f62910Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cebc705b097d5c16469b141a25e840161d1c517aPatch
Impacted products
Vendor Product Version
Linux Linux Version: 017a634f9f38ae704d9d57817555773de700219e
Version: 9a1aac8a96dc014bec49806a7a964bf2fdbd315f
Version: 9a1aac8a96dc014bec49806a7a964bf2fdbd315f
Version: 9a1aac8a96dc014bec49806a7a964bf2fdbd315f
Version: 9a1aac8a96dc014bec49806a7a964bf2fdbd315f
Version: 9a1aac8a96dc014bec49806a7a964bf2fdbd315f
 Create a notification for this product.
   Linux Linux Version: 6.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49886",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:44:59.932755Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:48:49.789Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/intel/speed_select_if/isst_if_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1973c4d8ee0782a808303d75e3be9c12baaacd97",
              "status": "affected",
              "version": "017a634f9f38ae704d9d57817555773de700219e",
              "versionType": "git"
            },
            {
              "lessThan": "cdd03afcb6eda3103da5a0948d3db12372f62910",
              "status": "affected",
              "version": "9a1aac8a96dc014bec49806a7a964bf2fdbd315f",
              "versionType": "git"
            },
            {
              "lessThan": "8176d4878ed2af5d93ddd0e971e24c412124d38b",
              "status": "affected",
              "version": "9a1aac8a96dc014bec49806a7a964bf2fdbd315f",
              "versionType": "git"
            },
            {
              "lessThan": "cebc705b097d5c16469b141a25e840161d1c517a",
              "status": "affected",
              "version": "9a1aac8a96dc014bec49806a7a964bf2fdbd315f",
              "versionType": "git"
            },
            {
              "lessThan": "afa7f78d9a907cfded6c98c91aae2bf7b3b56e51",
              "status": "affected",
              "version": "9a1aac8a96dc014bec49806a7a964bf2fdbd315f",
              "versionType": "git"
            },
            {
              "lessThan": "7d59ac07ccb58f8f604f8057db63b8efcebeb3de",
              "status": "affected",
              "version": "9a1aac8a96dc014bec49806a7a964bf2fdbd315f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/intel/speed_select_if/isst_if_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug\n\nAttaching SST PCI device to VM causes \"BUG: KASAN: slab-out-of-bounds\".\nkasan report:\n[   19.411889] ==================================================================\n[   19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[   19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113\n[   19.417368]\n[   19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G            E      6.9.0 #10\n[   19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022\n[   19.422687] Call Trace:\n[   19.424091]  \u003cTASK\u003e\n[   19.425448]  dump_stack_lvl+0x5d/0x80\n[   19.426963]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[   19.428694]  print_report+0x19d/0x52e\n[   19.430206]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[   19.431837]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[   19.433539]  kasan_report+0xf0/0x170\n[   19.435019]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[   19.436709]  _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[   19.438379]  ? __pfx_sched_clock_cpu+0x10/0x10\n[   19.439910]  isst_if_cpu_online+0x406/0x58f [isst_if_common]\n[   19.441573]  ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common]\n[   19.443263]  ? ttwu_queue_wakelist+0x2c1/0x360\n[   19.444797]  cpuhp_invoke_callback+0x221/0xec0\n[   19.446337]  cpuhp_thread_fun+0x21b/0x610\n[   19.447814]  ? __pfx_cpuhp_thread_fun+0x10/0x10\n[   19.449354]  smpboot_thread_fn+0x2e7/0x6e0\n[   19.450859]  ? __pfx_smpboot_thread_fn+0x10/0x10\n[   19.452405]  kthread+0x29c/0x350\n[   19.453817]  ? __pfx_kthread+0x10/0x10\n[   19.455253]  ret_from_fork+0x31/0x70\n[   19.456685]  ? __pfx_kthread+0x10/0x10\n[   19.458114]  ret_from_fork_asm+0x1a/0x30\n[   19.459573]  \u003c/TASK\u003e\n[   19.460853]\n[   19.462055] Allocated by task 1198:\n[   19.463410]  kasan_save_stack+0x30/0x50\n[   19.464788]  kasan_save_track+0x14/0x30\n[   19.466139]  __kasan_kmalloc+0xaa/0xb0\n[   19.467465]  __kmalloc+0x1cd/0x470\n[   19.468748]  isst_if_cdev_register+0x1da/0x350 [isst_if_common]\n[   19.470233]  isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr]\n[   19.471670]  do_one_initcall+0xa4/0x380\n[   19.472903]  do_init_module+0x238/0x760\n[   19.474105]  load_module+0x5239/0x6f00\n[   19.475285]  init_module_from_file+0xd1/0x130\n[   19.476506]  idempotent_init_module+0x23b/0x650\n[   19.477725]  __x64_sys_finit_module+0xbe/0x130\n[   19.476506]  idempotent_init_module+0x23b/0x650\n[   19.477725]  __x64_sys_finit_module+0xbe/0x130\n[   19.478920]  do_syscall_64+0x82/0x160\n[   19.480036]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   19.481292]\n[   19.482205] The buggy address belongs to the object at ffff888829e65000\n which belongs to the cache kmalloc-512 of size 512\n[   19.484818] The buggy address is located 0 bytes to the right of\n allocated 512-byte region [ffff888829e65000, ffff888829e65200)\n[   19.487447]\n[   19.488328] The buggy address belongs to the physical page:\n[   19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60\n[   19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n[   19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff)\n[   19.493914] page_type: 0xffffffff()\n[   19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001\n[   19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000\n[   19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001\n[   19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000\n[   19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff\n[   19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000\n[   19.503784] page dumped because: k\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:28:22.526Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1973c4d8ee0782a808303d75e3be9c12baaacd97"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdd03afcb6eda3103da5a0948d3db12372f62910"
        },
        {
          "url": "https://git.kernel.org/stable/c/8176d4878ed2af5d93ddd0e971e24c412124d38b"
        },
        {
          "url": "https://git.kernel.org/stable/c/cebc705b097d5c16469b141a25e840161d1c517a"
        },
        {
          "url": "https://git.kernel.org/stable/c/afa7f78d9a907cfded6c98c91aae2bf7b3b56e51"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d59ac07ccb58f8f604f8057db63b8efcebeb3de"
        }
      ],
      "title": "platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49886",
    "datePublished": "2024-10-21T18:01:22.870Z",
    "dateReserved": "2024-10-21T12:17:06.022Z",
    "dateUpdated": "2024-12-19T09:28:22.526Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49886\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T18:15:11.293\",\"lastModified\":\"2024-11-13T14:39:36.240\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nplatform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug\\n\\nAttaching SST PCI device to VM causes \\\"BUG: KASAN: slab-out-of-bounds\\\".\\nkasan report:\\n[   19.411889] ==================================================================\\n[   19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\\n[   19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113\\n[   19.417368]\\n[   19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G            E      6.9.0 #10\\n[   19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022\\n[   19.422687] Call Trace:\\n[   19.424091]  \u003cTASK\u003e\\n[   19.425448]  dump_stack_lvl+0x5d/0x80\\n[   19.426963]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\\n[   19.428694]  print_report+0x19d/0x52e\\n[   19.430206]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n[   19.431837]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\\n[   19.433539]  kasan_report+0xf0/0x170\\n[   19.435019]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\\n[   19.436709]  _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\\n[   19.438379]  ? __pfx_sched_clock_cpu+0x10/0x10\\n[   19.439910]  isst_if_cpu_online+0x406/0x58f [isst_if_common]\\n[   19.441573]  ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common]\\n[   19.443263]  ? ttwu_queue_wakelist+0x2c1/0x360\\n[   19.444797]  cpuhp_invoke_callback+0x221/0xec0\\n[   19.446337]  cpuhp_thread_fun+0x21b/0x610\\n[   19.447814]  ? __pfx_cpuhp_thread_fun+0x10/0x10\\n[   19.449354]  smpboot_thread_fn+0x2e7/0x6e0\\n[   19.450859]  ? __pfx_smpboot_thread_fn+0x10/0x10\\n[   19.452405]  kthread+0x29c/0x350\\n[   19.453817]  ? __pfx_kthread+0x10/0x10\\n[   19.455253]  ret_from_fork+0x31/0x70\\n[   19.456685]  ? __pfx_kthread+0x10/0x10\\n[   19.458114]  ret_from_fork_asm+0x1a/0x30\\n[   19.459573]  \u003c/TASK\u003e\\n[   19.460853]\\n[   19.462055] Allocated by task 1198:\\n[   19.463410]  kasan_save_stack+0x30/0x50\\n[   19.464788]  kasan_save_track+0x14/0x30\\n[   19.466139]  __kasan_kmalloc+0xaa/0xb0\\n[   19.467465]  __kmalloc+0x1cd/0x470\\n[   19.468748]  isst_if_cdev_register+0x1da/0x350 [isst_if_common]\\n[   19.470233]  isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr]\\n[   19.471670]  do_one_initcall+0xa4/0x380\\n[   19.472903]  do_init_module+0x238/0x760\\n[   19.474105]  load_module+0x5239/0x6f00\\n[   19.475285]  init_module_from_file+0xd1/0x130\\n[   19.476506]  idempotent_init_module+0x23b/0x650\\n[   19.477725]  __x64_sys_finit_module+0xbe/0x130\\n[   19.476506]  idempotent_init_module+0x23b/0x650\\n[   19.477725]  __x64_sys_finit_module+0xbe/0x130\\n[   19.478920]  do_syscall_64+0x82/0x160\\n[   19.480036]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n[   19.481292]\\n[   19.482205] The buggy address belongs to the object at ffff888829e65000\\n which belongs to the cache kmalloc-512 of size 512\\n[   19.484818] The buggy address is located 0 bytes to the right of\\n allocated 512-byte region [ffff888829e65000, ffff888829e65200)\\n[   19.487447]\\n[   19.488328] The buggy address belongs to the physical page:\\n[   19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60\\n[   19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0\\n[   19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff)\\n[   19.493914] page_type: 0xffffffff()\\n[   19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001\\n[   19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000\\n[   19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001\\n[   19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000\\n[   19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff\\n[   19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000\\n[   19.503784] page dumped because: k\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: plataforma/x86: ISST: Se corrige el error de informe KASAN slab-out-of-bounds. Conectar un dispositivo PCI SST a una m\u00e1quina virtual provoca \\\"BUG: KASAN: slab-out-of-bounds\\\". informe de kasan: [ 19.411889] ======================================================================= [ 19.413702] ERROR: KASAN: slab fuera de los l\u00edmites en _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.415634] Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff888829e65200 por la tarea cpuhp/16/113 [ 19.417368] [ 19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Contaminado: GE 6.9.0 #10 [ 19.420435] Nombre del hardware: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 28/07/2022 [ 19.422687] Seguimiento de llamadas: [ 19.424091]  [ 19.425448] dump_stack_lvl+0x5d/0x80 [ 19.426963] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.428694] print_report+0x19d/0x52e [ 19.430206] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 19.431837] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.433539] kasan_report+0xf0/0x170 [ 19.435019] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.436709] _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.438379] ? __pfx_sched_clock_cpu+0x10/0x10 [ 19.439910] isst_if_cpu_online+0x406/0x58f [isst_if_common] [ 19.441573] ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common] [ 19.443263] ? ttwu_queue_wakelist+0x2c1/0x360 [ 19.444797] cpuhp_invoke_callback+0x221/0xec0 [ 19.446337] cpuhp_thread_fun+0x21b/0x610 [ 19.447814] ? __pfx_cpuhp_thread_fun+0x10/0x10 [ 19.449354] smpboot_thread_fn+0x2e7/0x6e0 [ 19.450859] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 19.452405] kthread+0x29c/0x350 [ 19.453817] ? __pfx_kthread+0x10/0x10 [ 19.455253] ret_from_fork+0x31/0x70 [ 19.456685] ? __pfx_kthread+0x10/0x10 [ 19.458114] ret_from_fork_asm+0x1a/0x30 [ 19.459573]  [ 19.460853] [ 19.462055] Asignado por la tarea 1198: [ 19.463410] kasan_save_stack+0x30/0x50 [ 19.464788] kasan_save_track+0x14/0x30 [ 19.466139] __kasan_kmalloc+0xaa/0xb0 [ 19.467465] __kmalloc+0x1cd/0x470 [ 19.468748] isst_if_cdev_register+0x1da/0x350 [isst_if_common] [ 19.470233] isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr] [ 19.471670] do_one_initcall+0xa4/0x380 [ 19.472903] do_init_module+0x238/0x760 [ 19.474105] load_module+0x5239/0x6f00 [ 19.475285] init_module_from_file+0xd1/0x130 [ 19.476506] idempotent_init_module+0x23b/0x650 [ 19.477725] __x64_sys_finit_module+0xbe/0x130 [ 19.476506] idempotent_init_module+0x23b/0x650 [ 19.477725] __x64_sys_finit_module+0xbe/0x130 [ 19.478920] do_syscall_64+0x82/0x160 [ 19.480036] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 19.481292] [ 19.482205] La direcci\u00f3n con errores pertenece al objeto en ffff888829e65000 que pertenece a la cach\u00e9 kmalloc-512 de tama\u00f1o 512 [ 19.484818] La direcci\u00f3n con errores se encuentra 0 bytes a la derecha de la regi\u00f3n asignada de 512 bytes [ffff888829e65000, ffff888829e65200) [ 19.487447] [ 19.488328] La direcci\u00f3n con errores pertenece a la p\u00e1gina f\u00edsica: [ 19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60 [ 19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.492466] anon flags: 0x57ffffc0000840(losa|cabeza|nodo=1|zona=2|lastcpupid=0x1fffff) [ 19.493914] tipo_de_p\u00e1gina: 0xffffffff() [ 19.494988] sin procesar: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001 [ 19.496451] sin procesar: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000 [ 19.497906] cabeza: 0057ffffc0000840 ffff88810004cc80 0000000000000000 000000000000001 [ 19.499379] cabeza: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000 [ 19.500844] cabeza: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff [ 19.502316] cabeza: 0000000800000000 0000000000000000 00000000ffffffff 000000000000000 [ 19.503784] p\u00e1gina volcada porque: k ---truncada---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.115\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"1745FED1-C7B9-44F6-A2B7-C2FED07A22C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"E43F7555-891D-4BA1-85D1-7A6816C6083B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.55\",\"matchCriteriaId\":\"E90B9576-56C4-47BC-AAB0-C5B2D438F5D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.14\",\"matchCriteriaId\":\"4C16BCE0-FFA0-4599-BE0A-1FD65101C021\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1973c4d8ee0782a808303d75e3be9c12baaacd97\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d59ac07ccb58f8f604f8057db63b8efcebeb3de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8176d4878ed2af5d93ddd0e971e24c412124d38b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/afa7f78d9a907cfded6c98c91aae2bf7b3b56e51\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cdd03afcb6eda3103da5a0948d3db12372f62910\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cebc705b097d5c16469b141a25e840161d1c517a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49886\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:44:59.932755Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:45:03.452Z\"}}], \"cna\": {\"title\": \"platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"017a634f9f38ae704d9d57817555773de700219e\", \"lessThan\": \"1973c4d8ee0782a808303d75e3be9c12baaacd97\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9a1aac8a96dc014bec49806a7a964bf2fdbd315f\", \"lessThan\": \"cdd03afcb6eda3103da5a0948d3db12372f62910\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9a1aac8a96dc014bec49806a7a964bf2fdbd315f\", \"lessThan\": \"8176d4878ed2af5d93ddd0e971e24c412124d38b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9a1aac8a96dc014bec49806a7a964bf2fdbd315f\", \"lessThan\": \"cebc705b097d5c16469b141a25e840161d1c517a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9a1aac8a96dc014bec49806a7a964bf2fdbd315f\", \"lessThan\": \"afa7f78d9a907cfded6c98c91aae2bf7b3b56e51\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9a1aac8a96dc014bec49806a7a964bf2fdbd315f\", \"lessThan\": \"7d59ac07ccb58f8f604f8057db63b8efcebeb3de\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/platform/x86/intel/speed_select_if/isst_if_common.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.55\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/platform/x86/intel/speed_select_if/isst_if_common.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/1973c4d8ee0782a808303d75e3be9c12baaacd97\"}, {\"url\": \"https://git.kernel.org/stable/c/cdd03afcb6eda3103da5a0948d3db12372f62910\"}, {\"url\": \"https://git.kernel.org/stable/c/8176d4878ed2af5d93ddd0e971e24c412124d38b\"}, {\"url\": \"https://git.kernel.org/stable/c/cebc705b097d5c16469b141a25e840161d1c517a\"}, {\"url\": \"https://git.kernel.org/stable/c/afa7f78d9a907cfded6c98c91aae2bf7b3b56e51\"}, {\"url\": \"https://git.kernel.org/stable/c/7d59ac07ccb58f8f604f8057db63b8efcebeb3de\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nplatform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug\\n\\nAttaching SST PCI device to VM causes \\\"BUG: KASAN: slab-out-of-bounds\\\".\\nkasan report:\\n[   19.411889] ==================================================================\\n[   19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\\n[   19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113\\n[   19.417368]\\n[   19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G            E      6.9.0 #10\\n[   19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022\\n[   19.422687] Call Trace:\\n[   19.424091]  \u003cTASK\u003e\\n[   19.425448]  dump_stack_lvl+0x5d/0x80\\n[   19.426963]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\\n[   19.428694]  print_report+0x19d/0x52e\\n[   19.430206]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n[   19.431837]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\\n[   19.433539]  kasan_report+0xf0/0x170\\n[   19.435019]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\\n[   19.436709]  _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\\n[   19.438379]  ? __pfx_sched_clock_cpu+0x10/0x10\\n[   19.439910]  isst_if_cpu_online+0x406/0x58f [isst_if_common]\\n[   19.441573]  ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common]\\n[   19.443263]  ? ttwu_queue_wakelist+0x2c1/0x360\\n[   19.444797]  cpuhp_invoke_callback+0x221/0xec0\\n[   19.446337]  cpuhp_thread_fun+0x21b/0x610\\n[   19.447814]  ? __pfx_cpuhp_thread_fun+0x10/0x10\\n[   19.449354]  smpboot_thread_fn+0x2e7/0x6e0\\n[   19.450859]  ? __pfx_smpboot_thread_fn+0x10/0x10\\n[   19.452405]  kthread+0x29c/0x350\\n[   19.453817]  ? __pfx_kthread+0x10/0x10\\n[   19.455253]  ret_from_fork+0x31/0x70\\n[   19.456685]  ? __pfx_kthread+0x10/0x10\\n[   19.458114]  ret_from_fork_asm+0x1a/0x30\\n[   19.459573]  \u003c/TASK\u003e\\n[   19.460853]\\n[   19.462055] Allocated by task 1198:\\n[   19.463410]  kasan_save_stack+0x30/0x50\\n[   19.464788]  kasan_save_track+0x14/0x30\\n[   19.466139]  __kasan_kmalloc+0xaa/0xb0\\n[   19.467465]  __kmalloc+0x1cd/0x470\\n[   19.468748]  isst_if_cdev_register+0x1da/0x350 [isst_if_common]\\n[   19.470233]  isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr]\\n[   19.471670]  do_one_initcall+0xa4/0x380\\n[   19.472903]  do_init_module+0x238/0x760\\n[   19.474105]  load_module+0x5239/0x6f00\\n[   19.475285]  init_module_from_file+0xd1/0x130\\n[   19.476506]  idempotent_init_module+0x23b/0x650\\n[   19.477725]  __x64_sys_finit_module+0xbe/0x130\\n[   19.476506]  idempotent_init_module+0x23b/0x650\\n[   19.477725]  __x64_sys_finit_module+0xbe/0x130\\n[   19.478920]  do_syscall_64+0x82/0x160\\n[   19.480036]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n[   19.481292]\\n[   19.482205] The buggy address belongs to the object at ffff888829e65000\\n which belongs to the cache kmalloc-512 of size 512\\n[   19.484818] The buggy address is located 0 bytes to the right of\\n allocated 512-byte region [ffff888829e65000, ffff888829e65200)\\n[   19.487447]\\n[   19.488328] The buggy address belongs to the physical page:\\n[   19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60\\n[   19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0\\n[   19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff)\\n[   19.493914] page_type: 0xffffffff()\\n[   19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001\\n[   19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000\\n[   19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001\\n[   19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000\\n[   19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff\\n[   19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000\\n[   19.503784] page dumped because: k\\n---truncated---\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:28:22.526Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49886\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:28:22.526Z\", \"dateReserved\": \"2024-10-21T12:17:06.022Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:01:22.870Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.