CVE-2024-56677

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()

During early init CMA_MIN_ALIGNMENT_BYTES can be PAGE_SIZE,

since pageblock_order is still zero and it gets initialized

later during initmem_init() e.g.

setup_arch() -> initmem_init() -> sparse_init() -> set_pageblock_order()

One such use case where this causes issue is -

early_setup() -> early_init_devtree() -> fadump_reserve_mem() -> fadump_cma_init()

This causes CMA memory alignment check to be bypassed in

cma_init_reserved_mem(). Then later cma_activate_area() can hit

a VM_BUG_ON_PAGE(pfn & ((1 << order) - 1)) if the reserved memory

area was not pageblock_order aligned.

Fix it by moving the fadump_cma_init() after initmem_init(),

where other such cma reservations also gets called.

<stack trace>

==============

page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10010

flags: 0x13ffff800000000(node=1|zone=0|lastcpupid=0x7f

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References