CVE-2024-56673

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

riscv: mm: Do not call pmd dtor on vmemmap page table teardown

The vmemmap's, which is used for RV64 with SPARSEMEM_VMEMMAP, page

tables are populated using pmd (page middle directory) hugetables.

However, the pmd allocation is not using the generic mechanism used by

the VMA code (e.g. pmd_alloc()), or the RISC-V specific

create_pgd_mapping()/alloc_pmd_late(). Instead, the vmemmap page table

code allocates a page, and calls vmemmap_set_pmd(). This results in

that the pmd ctor is *not* called, nor would it make sense to do so.

Now, when tearing down a vmemmap page table pmd, the cleanup code

would unconditionally, and incorrectly call the pmd dtor, which

results in a crash (best case).

This issue was found when running the HMM selftests:

| tools/testing/selftests/mm# ./test_hmm.sh smoke

| ... # when unloading the test_hmm.ko module

| page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10915b

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References