CVE-2024-26983

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bootconfig: use memblock_free_late to free xbc memory to buddy

On the time to free xbc memory in xbc_exit(), memblock may has handed

over memory to buddy allocator. So it doesn't make sense to free memory

back to memblock. memblock_free() called by xbc_exit() even causes UAF bugs

on architectures with CONFIG_ARCH_KEEP_MEMBLOCK disabled like x86.

Following KASAN logs shows this case.

This patch fixes the xbc memory free problem by calling memblock_free()

in early xbc init error rewind path and calling memblock_free_late() in

xbc exit path to free memory to buddy allocator.

[ 9.410890] ==================================================================

[ 9.418962] BUG: KASAN: use-after-free in memblock_isolate_range+0x12d/0x260

[ 9.426850] Read of size 8 at addr ffff88845dd30000 by task swapper/0/1

[ 9.435901] CPU: 9 PID: 1 Comm: swapper/0 Tainted: G U 6.9.0-rc3-00208-g586b5dfb51b9 #5

[

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References