CVE-2024-50022

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

device-dax: correct pgoff align in dax_set_mapping()

pgoff should be aligned using ALIGN_DOWN() instead of ALIGN(). Otherwise,

vmf->address not aligned to fault_size will be aligned to the next

alignment, that can result in memory failure getting the wrong address.

It's a subtle situation that only can be observed in

page_mapped_in_vma() after the page is page fault handled by

dev_dax_huge_fault. Generally, there is little chance to perform

page_mapped_in_vma in dev-dax's page unless in specific error injection

to the dax device to trigger an MCE - memory-failure. In that case,

page_mapped_in_vma() will be triggered to determine which task is

accessing the failure address and kill that task in the end.

We used self-developed dax device (which is 2M aligned mapping) , to

perform error injection to random address. It turned out that error

injected to non-2M-aligned address was causing endless MCE until panic.

Be

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References