CVE-2021-46910

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabled

The debugging code for kmap_local() doubles the number of per-CPU fixmap

slots allocated for kmap_local(), in order to use half of them as guard

regions. This causes the fixmap region to grow downwards beyond the start

of its reserved window if the supported number of CPUs is large, and collide

with the newly added virtual DT mapping right below it, which is obviously

not good.

One manifestation of this is EFI boot on a kernel built with NR_CPUS=32

and CONFIG_DEBUG_KMAP_LOCAL=y, which may pass the FDT in highmem, resulting

in block entries below the fixmap region that the fixmap code misidentifies

as fixmap table entries, and subsequently tries to dereference using a

phys-to-virt translation that is only valid for lowmem. This results in a

cryptic splat such as the one below.

ftrace: allocating 45548 entries in 89 pages

8<--- cut here

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References