{"timestamp":"2024-09-29T15:47:43.491220Z","id":"CVE-2024-45022","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/vmalloc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fe5c2bdcb14c8612eb5e7a09159801c7219e9ac4","lessThan":"fd1ffbb50ef4da5e1378a46616b6d7407dc795da","versionType":"git","status":"affected"},{"version":"e9c3cda4d86e56bf7fe403729f38c4f0f65d3860","lessThan":"de7bad86345c43cd040ed43e20d9fad78a3ee59f","versionType":"git","status":"affected"},{"version":"e9c3cda4d86e56bf7fe403729f38c4f0f65d3860","lessThan":"c91618816f4d21fc574d7577a37722adcd4075b2","versionType":"git","status":"affected"},{"version":"e9c3cda4d86e56bf7fe403729f38c4f0f65d3860","lessThan":"61ebe5a747da649057c37be1c37eb934b4af79ca","versionType":"git","status":"affected"},{"version":"6.1.95","lessThan":"6.1.107","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/vmalloc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","versionType":"semver","status":"unaffected"},{"version":"6.1.107","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.48","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.10.7","lessThanOrEqual":"6.10.*","versionType":"semver","status":"unaffected"},{"version":"6.11","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NIST CWE-787

OR
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.95 up to (excluding) 6.1.107
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.3 up to (excluding) 6.6.48
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.10.7
     *cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
     *cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*
     *cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*

https://git.kernel.org/stable/c/61ebe5a747da649057c37be1c37eb934b4af79ca No Types Assigned

https://git.kernel.org/stable/c/61ebe5a747da649057c37be1c37eb934b4af79ca Patch

https://git.kernel.org/stable/c/c91618816f4d21fc574d7577a37722adcd4075b2 No Types Assigned

https://git.kernel.org/stable/c/c91618816f4d21fc574d7577a37722adcd4075b2 Patch

https://git.kernel.org/stable/c/de7bad86345c43cd040ed43e20d9fad78a3ee59f No Types Assigned

https://git.kernel.org/stable/c/de7bad86345c43cd040ed43e20d9fad78a3ee59f Patch

https://git.kernel.org/stable/c/fd1ffbb50ef4da5e1378a46616b6d7407dc795da No Types Assigned

https://git.kernel.org/stable/c/fd1ffbb50ef4da5e1378a46616b6d7407dc795da Patch

In the Linux kernel, the following vulnerability has been resolved:

mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0

The __vmap_pages_range_noflush() assumes its argument pages** contains
pages with the same page shift.  However, since commit e9c3cda4d86e ("mm,
vmalloc: fix high order __GFP_NOFAIL allocations"), if gfp_flags includes
__GFP_NOFAIL with high order in vm_area_alloc_pages() and page allocation
failed for high order, the pages** may contain two different page shifts
(high order and order-0).  This could lead __vmap_pages_range_noflush() to
perform incorrect mappings, potentially resulting in memory corruption.

Users might encounter this as follows (vmap_allow_huge = true, 2M is for
PMD_SIZE):

kvmalloc(2M, __GFP_NOFAIL|GFP_X)
    __vmalloc_node_range_noprof(vm_flags=VM_ALLOW_HUGE_VMAP)
        vm_area_alloc_pages(order=9) ---> order-9 allocation failed and fallback to order-0
            vmap_pages_range()
                vmap_pages_range_noflush()
                    __vmap_pages_range_noflush(page_shift = 21) ----> wrong mapping happens

We can remove the fallback code because if a high-order allocation fails,
__vmalloc_node_range_noprof() will retry with order-0.  Therefore, it is
unnecessary to fallback to order-0 here.  Therefore, fix this by removing
the fallback code.

kernel.org https://git.kernel.org/stable/c/61ebe5a747da649057c37be1c37eb934b4af79ca [No types assigned]

kernel.org https://git.kernel.org/stable/c/c91618816f4d21fc574d7577a37722adcd4075b2 [No types assigned]

kernel.org https://git.kernel.org/stable/c/de7bad86345c43cd040ed43e20d9fad78a3ee59f [No types assigned]

kernel.org https://git.kernel.org/stable/c/fd1ffbb50ef4da5e1378a46616b6d7407dc795da [No types assigned]