CVE-2024-50303

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

resource,kexec: walk_system_ram_res_rev must retain resource flags

walk_system_ram_res_rev() erroneously discards resource flags when passing

the information to the callback.

This causes systems with IORESOURCE_SYSRAM_DRIVER_MANAGED memory to have

these resources selected during kexec to store kexec buffers if that

memory happens to be at placed above normal system ram.

This leads to undefined behavior after reboot. If the kexec buffer is

never touched, nothing happens. If the kexec buffer is touched, it could

lead to a crash (like below) or undefined behavior.

Tested on a system with CXL memory expanders with driver managed memory,

TPM enabled, and CONFIG_IMA_KEXEC=y. Adding printk's showed the flags

were being discarded and as a result the check for

IORESOURCE_SYSRAM_DRIVER_MANAGED passes.

find_next_iomem_res: name(System RAM (kmem))

start(10000000000)

end(1034fffffff)

flags(83000200)

l

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References