linux-cve-announce - CVE-2024-46852: dma-buf: heaps: Fix off-by-one in CMA heap fault handler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024092742-CVE-2024-46852-91a5@gregkh>
Date: Fri, 27 Sep 2024 14:43:45 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-46852: dma-buf: heaps: Fix off-by-one in CMA heap fault handler

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

dma-buf: heaps: Fix off-by-one in CMA heap fault handler

Until VM_DONTEXPAND was added in commit 1c1914d6e8c6 ("dma-buf: heaps:
Don't track CMA dma-buf pages under RssFile") it was possible to obtain
a mapping larger than the buffer size via mremap and bypass the overflow
check in dma_buf_mmap_internal. When using such a mapping to attempt to
fault past the end of the buffer, the CMA heap fault handler also checks
the fault offset against the buffer size, but gets the boundary wrong by
1. Fix the boundary check so that we don't read off the end of the pages
array and insert an arbitrary page in the mapping.

The Linux kernel CVE team has assigned CVE-2024-46852 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.11 with commit a5d2d29e24be and fixed in 6.1.111 with commit 84175dc5b2c9
	Issue introduced in 5.11 with commit a5d2d29e24be and fixed in 6.6.52 with commit eb7fc8b65cea
	Issue introduced in 5.11 with commit a5d2d29e24be and fixed in 6.10.11 with commit e79050882b85
	Issue introduced in 5.11 with commit a5d2d29e24be and fixed in 6.11 with commit ea5ff5d351b5

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-46852
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/dma-buf/heaps/cma_heap.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/84175dc5b2c932266a50c04e5ce342c30f817a2f
	https://git.kernel.org/stable/c/eb7fc8b65cea22f9038c52398c8b22849e9620ea
	https://git.kernel.org/stable/c/e79050882b857c37634baedbdcf7c2047c24cbff
	https://git.kernel.org/stable/c/ea5ff5d351b520524019f7ff7f9ce418de2dad87