{ "dataType": "CVE_RECORD", "cveMetadata": { "cveId": "CVE-2024-26906", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.187Z", "datePublished": "2024-04-17T10:27:53.573Z", "dateUpdated": "2024-09-11T17:33:22.186Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:24:48.107Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()\n\nWhen trying to use copy_from_kernel_nofault() to read vsyscall page\nthrough a bpf program, the following oops was reported:\n\n BUG: unable to handle page fault for address: ffffffffff600000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 3231067 P4D 3231067 PUD 3233067 PMD 3235067 PTE 0\n Oops: 0000 [#1] PREEMPT SMP PTI\n CPU: 1 PID: 20390 Comm: test_progs ...... 6.7.0+ #58\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......\n RIP: 0010:copy_from_kernel_nofault+0x6f/0x110\n ......\n Call Trace:\n \n ? copy_from_kernel_nofault+0x6f/0x110\n bpf_probe_read_kernel+0x1d/0x50\n bpf_prog_2061065e56845f08_do_probe_read+0x51/0x8d\n trace_call_bpf+0xc5/0x1c0\n perf_call_bpf_enter.isra.0+0x69/0xb0\n perf_syscall_enter+0x13e/0x200\n syscall_trace_enter+0x188/0x1c0\n do_syscall_64+0xb5/0xe0\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\n \n ......\n ---[ end trace 0000000000000000 ]---\n\nThe oops is triggered when:\n\n1) A bpf program uses bpf_probe_read_kernel() to read from the vsyscall\npage and invokes copy_from_kernel_nofault() which in turn calls\n__get_user_asm().\n\n2) Because the vsyscall page address is not readable from kernel space,\na page fault exception is triggered accordingly.\n\n3) handle_page_fault() considers the vsyscall page address as a user\nspace address instead of a kernel space address. This results in the\nfix-up setup by bpf not being applied and a page_fault_oops() is invoked\ndue to SMAP.\n\nConsidering handle_page_fault() has already considered the vsyscall page\naddress as a userspace address, fix the problem by disallowing vsyscall\npage read for copy_from_kernel_nofault()." } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/mm/maccess.c" ], "versions": [ { "version": "1da177e4c3f4", "lessThan": "6e4694e65b6d", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f4", "lessThan": "e8a67fe34b76", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f4", "lessThan": "f175de546a3e", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f4", "lessThan": "57f78c46f081", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f4", "lessThan": "29bd6f869046", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f4", "lessThan": "32019c659ecf", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/x86/mm/maccess.c" ], "versions": [ { "version": "5.10.214", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "custom" }, { "version": "5.15.153", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "custom" }, { "version": "6.1.83", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "custom" }, { "version": "6.6.23", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "custom" }, { "version": "6.7.11", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "custom" }, { "version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/6e4694e65b6db4c3de125115dd4f55848cc48381" }, { "url": "https://git.kernel.org/stable/c/e8a67fe34b76a49320b33032228a794f40b0316b" }, { "url": "https://git.kernel.org/stable/c/f175de546a3eb77614d94d4c02550181c0a8493e" }, { "url": "https://git.kernel.org/stable/c/57f78c46f08198e1be08ffe99c4c1ccc12855bf5" }, { "url": "https://git.kernel.org/stable/c/29bd6f86904682adafe9affbc7f79b14defcaff8" }, { "url": "https://git.kernel.org/stable/c/32019c659ecfe1d92e3bf9fcdfbb11a7c70acd58" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html" } ], "title": "x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()", "x_generator": { "engine": "bippy-a5840b7849dd" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.490Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/6e4694e65b6db4c3de125115dd4f55848cc48381", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/e8a67fe34b76a49320b33032228a794f40b0316b", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/f175de546a3eb77614d94d4c02550181c0a8493e", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/57f78c46f08198e1be08ffe99c4c1ccc12855bf5", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/29bd6f86904682adafe9affbc7f79b14defcaff8", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/32019c659ecfe1d92e3bf9fcdfbb11a7c70acd58", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-26906", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T15:47:59.842385Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:22.186Z" } } ] }, "dataVersion": "5.1" }