CVE-2024-57881

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-57881

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy() In split_large_buddy(), we might call pfn_to_page() on a PFN that might not exist. In corner cases, such as when freeing the highest pageblock in the last memory section, this could result with CONFIG_SPARSEMEM && !CONFIG_SPARSEMEM_EXTREME in __pfn_to_section() returning NULL and and __section_mem_map_addr() dereferencing that NULL pointer. Let's fix it, and avoid doing a pfn_to_page() call for the first iteration, where we already have the page. So far this was found by code inspection, but let's just CC stable as the fix is easy.

References
Link Resource
https://git.kernel.org/stable/c/4234ca9884bcae9e48ed38652d91696ad5cd591d Patch
https://git.kernel.org/stable/c/faeec8e23c10bd30e8aa759a2eb3018dae00f924 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
History

16 Jan 2025, 15:20

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/4234ca9884bcae9e48ed38652d91696ad5cd591d - () https://git.kernel.org/stable/c/4234ca9884bcae9e48ed38652d91696ad5cd591d - Patch
References () https://git.kernel.org/stable/c/faeec8e23c10bd30e8aa759a2eb3018dae00f924 - () https://git.kernel.org/stable/c/faeec8e23c10bd30e8aa759a2eb3018dae00f924 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm/page_alloc: no llamar a pfn_to_page() en PFN posiblemente inexistente en split_large_buddy() En split_large_buddy(), podríamos llamar a pfn_to_page() en un PFN que podría no existir. En casos especiales, como al liberar el bloque de página más alto en la última sección de memoria, esto podría resultar en que CONFIG_SPARSEMEM && !CONFIG_SPARSEMEM_EXTREME en __pfn_to_section() devuelva NULL y __section_mem_map_addr() desreferenciando ese puntero NULL. Vamos a solucionarlo y evitar hacer una llamada a pfn_to_page() para la primera iteración, donde ya tenemos la página. Hasta ahora esto se encontró mediante inspección de código, pero simplemente controlemos CC estable ya que la solución es fácil.
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
CWE CWE-476

11 Jan 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-11 16:15

Updated : 2025-10-01 20:18

NVD link : CVE-2024-57881

Mitre link : CVE-2024-57881

CVE.ORG link : CVE-2024-57881

JSON object : View

Products Affected

linux

CWE
CWE-476

NULL Pointer Dereference