CVE-2024-26947

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses

Since commit a4d5613c4dc6 ("arm: extend pfn_valid to take into account

freed memory map alignment") changes the semantics of pfn_valid() to check

presence of the memory map for a PFN. A valid page for an address which

is reserved but not mapped by the kernel[1], the system crashed during

some uio test with the following memory layout:

node 0: [mem 0x00000000c0a00000-0x00000000cc8fffff]

node 0: [mem 0x00000000d0000000-0x00000000da1fffff]

the uio layout is：0xc0900000, 0x100000

the crash backtrace like:

Unable to handle kernel paging request at virtual address bff00000

[...]

CPU: 1 PID: 465 Comm: startapp.bin Tainted: G O 5.10.0 #1

Hardware name: Generic DT based system

PC is at b15_flush_kern_dcache_area+0x24/0x3c

LR is at __sync_icache_dcache+0x6c/0x98

[...]

(b15_flush_kern_dcache_area) from (__sync_ic

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References