Description

In the Linux kernel, the following vulnerability has been resolved: powerpc/kasan: Fix early region not updated correctly The shadow's page table is not updated when PTE_RPN_SHIFT is 24 and PAGE_SHIFT is 12. It not only causes false positives but also false negative as shown the following text. Fix it by bringing the logic of kasan_early_shadow_page_entry here. 1. False Positive: ================================================================== BUG: KASAN: vmalloc-out-of-bounds in pcpu_alloc+0x508/0xa50 Write of size 16 at addr f57f3be0 by task swapper/0/1 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.15.0-12267-gdebe436e77c7 #1 Call Trace: [c80d1c20] [c07fe7b8] dump_stack_lvl+0x4c/0x6c (unreliable) [c80d1c40] [c02ff668] print_address_description.constprop.0+0x88/0x300 [c80d1c70] [c02ff45c] kasan_report+0x1ec/0x200 [c80d1cb0] [c0300b20] kasan_check_range+0x160/0x2f0 [c80d1cc0] [c03018a4] memset+0x34/0x90 [c80d1ce0] [c0280108] pcpu_alloc+0x508/0xa50 [c80d1d40] [c02fd7bc] __kmem_cache_create+0xfc/0x570 [c80d1d70] [c0283d64] kmem_cache_create_usercopy+0x274/0x3e0 [c80d1db0] [c2036580] init_sd+0xc4/0x1d0 [c80d1de0] [c00044a0] do_one_initcall+0xc0/0x33c [c80d1eb0] [c2001624] kernel_init_freeable+0x2c8/0x384 [c80d1ef0] [c0004b14] kernel_init+0x24/0x170 [c80d1f10] [c001b26c] ret_from_kernel_thread+0x5c/0x64 Memory state around the buggy address: f57f3a80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f57f3b00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 >f57f3b80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ f57f3c00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f57f3c80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ================================================================== 2. False Negative (with KASAN tests): ================================================================== Before fix: ok 45 - kmalloc_double_kzfree # vmalloc_oob: EXPECTATION FAILED at lib/test_kasan.c:1039 KASAN failure expected in "((volatile char *)area)[3100]", but none occurred not ok 46 - vmalloc_oob not ok 1 - kasan ================================================================== After fix: ok 1 - kasan

Metrics

 

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score:  7.8 HIGH

Vector:  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0 Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
https://git.kernel.org/stable/c/5a3d8f3192a409893c57808cc935e16484df1068	Patch
https://git.kernel.org/stable/c/7f19245c3647afea8c7c41f795506ef70f64b9f2	Patch
https://git.kernel.org/stable/c/dd75080aa8409ce10d50fb58981c6b59bf8707d3	Patch
https://git.kernel.org/stable/c/de56beace6648065d404cd9835aa7d30e3df519d	Patch
https://git.kernel.org/stable/c/e3d157a4b4f4e0268c98be5b7013bf4b31234bb6	Patch
https://git.kernel.org/stable/c/f39a3309393a4a484532f6ba745c6acbcfe06115	Patch

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-787	Out-of-bounds Write	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

2 change records found show changes

Initial Analysis by NIST 3/18/2025 3:09:21 PM

Action	Type	Old Value	New Value
Added	CVSS V3.1		AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Added	CWE		CWE-787
Added	CPE Configuration		Record truncated, showing 500 of 565 characters. View Entire Change Record OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.33 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.17 up to (excluding) 5.17.2 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.110 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 5.16.19 *cpe:2.3:o:linux:linux_kernel:*:*:*:
Added	Reference Type		kernel.org: https://git.kernel.org/stable/c/5a3d8f3192a409893c57808cc935e16484df1068 Types: Patch
Added	Reference Type		kernel.org: https://git.kernel.org/stable/c/7f19245c3647afea8c7c41f795506ef70f64b9f2 Types: Patch
Added	Reference Type		kernel.org: https://git.kernel.org/stable/c/dd75080aa8409ce10d50fb58981c6b59bf8707d3 Types: Patch
Added	Reference Type		kernel.org: https://git.kernel.org/stable/c/de56beace6648065d404cd9835aa7d30e3df519d Types: Patch
Added	Reference Type		kernel.org: https://git.kernel.org/stable/c/e3d157a4b4f4e0268c98be5b7013bf4b31234bb6 Types: Patch
Added	Reference Type		kernel.org: https://git.kernel.org/stable/c/f39a3309393a4a484532f6ba745c6acbcfe06115 Types: Patch

New CVE Received from kernel.org 2/26/2025 1:37:05 AM

Action	Type	Old Value	New Value
Added	Description		Record truncated, showing 500 of 2217 characters. View Entire Change Record In the Linux kernel, the following vulnerability has been resolved: powerpc/kasan: Fix early region not updated correctly The shadow's page table is not updated when PTE_RPN_SHIFT is 24 and PAGE_SHIFT is 12. It not only causes false positives but also false negative as shown the following text. Fix it by bringing the logic of kasan_early_shadow_page_entry here. 1. False Positive: ================================================================== BUG: KASAN: vmalloc-out-of-bounds in pcpu_allo
Added	Reference		https://git.kernel.org/stable/c/5a3d8f3192a409893c57808cc935e16484df1068
Added	Reference		https://git.kernel.org/stable/c/7f19245c3647afea8c7c41f795506ef70f64b9f2
Added	Reference		https://git.kernel.org/stable/c/dd75080aa8409ce10d50fb58981c6b59bf8707d3
Added	Reference		https://git.kernel.org/stable/c/de56beace6648065d404cd9835aa7d30e3df519d
Added	Reference		https://git.kernel.org/stable/c/e3d157a4b4f4e0268c98be5b7013bf4b31234bb6
Added	Reference		https://git.kernel.org/stable/c/f39a3309393a4a484532f6ba745c6acbcfe06115