CVE-2024-26795 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: riscv: Sparse-Memory/vmemmap out-of-bounds fix Offset vmemmap so that the first page of vmemmap will be mapped to the first page of physical memory in order to ensure that vmemmap’s bounds will be respected during pfn_to_page()/page_to_pfn() operations. The conversion macros will produce correct SV39/48/57 addresses for every possible/valid DRAM_BASE inside the physical memory limits. v2:Address Alex's comments

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/2a1728c15ec4f45ed9248ae22f626541c179bfbe
https://git.kernel.org/stable/c/5941a90c55d3bfba732b32208d58d997600b44ef
https://git.kernel.org/stable/c/8310080799b40fd9f2a8b808c657269678c149af
https://git.kernel.org/stable/c/8af1c121b0102041809bc137ec600d1865eaeedd
https://git.kernel.org/stable/c/a11dd49dcb9376776193e15641f84fcc1e5980c9
https://git.kernel.org/stable/c/a278d5c60f21aa15d540abb2f2da6e6d795c3e6e
https://lore.kernel.org/linux-cve-announce/2024040402-CVE-2024-26795-404a@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-26795
https://www.cve.org/CVERecord?id=CVE-2024-26795

History

Wed, 06 Nov 2024 20:15:00 +0000

Type	Values Removed	Values Added
References	https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 19 Sep 2024 10:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-04-04T08:20:25.063Z

Updated: 2024-11-05T09:15:58.089Z

Reserved: 2024-02-19T14:20:24.178Z

Link: CVE-2024-26795

Vulnrichment

Updated: 2024-08-02T00:14:13.470Z

NVD

Status : Awaiting Analysis

Published: 2024-04-04T09:15:08.740

Modified: 2024-11-05T10:15:50.683

Link: CVE-2024-26795

Redhat

Severity : Moderate

Publid Date: 2024-04-04T00:00:00Z

Links: CVE-2024-26795 - Bugzilla

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-26795", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.178Z", "datePublished": "2024-04-04T08:20:25.063Z", "dateUpdated": "2024-11-05T09:15:58.089Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-05T09:15:58.089Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Sparse-Memory/vmemmap out-of-bounds fix\n\nOffset vmemmap so that the first page of vmemmap will be mapped\nto the first page of physical memory in order to ensure that\nvmemmap\u2019s bounds will be respected during\npfn_to_page()/page_to_pfn() operations.\nThe conversion macros will produce correct SV39/48/57 addresses\nfor every possible/valid DRAM_BASE inside the physical memory limits.\n\nv2:Address Alex's comments"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/riscv/include/asm/pgtable.h"], "versions": [{"version": "d95f1a542c3d", "lessThan": "8af1c121b010", "status": "affected", "versionType": "git"}, {"version": "d95f1a542c3d", "lessThan": "5941a90c55d3", "status": "affected", "versionType": "git"}, {"version": "d95f1a542c3d", "lessThan": "8310080799b4", "status": "affected", "versionType": "git"}, {"version": "d95f1a542c3d", "lessThan": "a278d5c60f21", "status": "affected", "versionType": "git"}, {"version": "d95f1a542c3d", "lessThan": "2a1728c15ec4", "status": "affected", "versionType": "git"}, {"version": "d95f1a542c3d", "lessThan": "a11dd49dcb93", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/riscv/include/asm/pgtable.h"], "versions": [{"version": "5.4", "status": "affected"}, {"version": "0", "lessThan": "5.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.212", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.151", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.81", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.21", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.9", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/8af1c121b0102041809bc137ec600d1865eaeedd"}, {"url": "https://git.kernel.org/stable/c/5941a90c55d3bfba732b32208d58d997600b44ef"}, {"url": "https://git.kernel.org/stable/c/8310080799b40fd9f2a8b808c657269678c149af"}, {"url": "https://git.kernel.org/stable/c/a278d5c60f21aa15d540abb2f2da6e6d795c3e6e"}, {"url": "https://git.kernel.org/stable/c/2a1728c15ec4f45ed9248ae22f626541c179bfbe"}, {"url": "https://git.kernel.org/stable/c/a11dd49dcb9376776193e15641f84fcc1e5980c9"}], "title": "riscv: Sparse-Memory/vmemmap out-of-bounds fix", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-17T19:27:22.580328Z", "id": "CVE-2024-26795", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T19:27:29.143Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.470Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/8af1c121b0102041809bc137ec600d1865eaeedd", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/5941a90c55d3bfba732b32208d58d997600b44ef", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8310080799b40fd9f2a8b808c657269678c149af", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a278d5c60f21aa15d540abb2f2da6e6d795c3e6e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2a1728c15ec4f45ed9248ae22f626541c179bfbe", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a11dd49dcb9376776193e15641f84fcc1e5980c9", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/8af1c121b0102041809bc137ec600d1865eaeedd", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/5941a90c55d3bfba732b32208d58d997600b44ef", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/8310080799b40fd9f2a8b808c657269678c149af", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a278d5c60f21aa15d540abb2f2da6e6d795c3e6e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2a1728c15ec4f45ed9248ae22f626541c179bfbe", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a11dd49dcb9376776193e15641f84fcc1e5980c9", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.470Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26795", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-17T19:27:22.580328Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T19:27:26.737Z"}}], "cna": {"title": "riscv: Sparse-Memory/vmemmap out-of-bounds fix", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d95f1a542c3d", "lessThan": "8af1c121b010", "versionType": "git"}, {"status": "affected", "version": "d95f1a542c3d", "lessThan": "5941a90c55d3", "versionType": "git"}, {"status": "affected", "version": "d95f1a542c3d", "lessThan": "8310080799b4", "versionType": "git"}, {"status": "affected", "version": "d95f1a542c3d", "lessThan": "a278d5c60f21", "versionType": "git"}, {"status": "affected", "version": "d95f1a542c3d", "lessThan": "2a1728c15ec4", "versionType": "git"}, {"status": "affected", "version": "d95f1a542c3d", "lessThan": "a11dd49dcb93", "versionType": "git"}], "programFiles": ["arch/riscv/include/asm/pgtable.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.4"}, {"status": "unaffected", "version": "0", "lessThan": "5.4", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.212", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.151", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.81", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.21", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.9", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/riscv/include/asm/pgtable.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/8af1c121b0102041809bc137ec600d1865eaeedd"}, {"url": "https://git.kernel.org/stable/c/5941a90c55d3bfba732b32208d58d997600b44ef"}, {"url": "https://git.kernel.org/stable/c/8310080799b40fd9f2a8b808c657269678c149af"}, {"url": "https://git.kernel.org/stable/c/a278d5c60f21aa15d540abb2f2da6e6d795c3e6e"}, {"url": "https://git.kernel.org/stable/c/2a1728c15ec4f45ed9248ae22f626541c179bfbe"}, {"url": "https://git.kernel.org/stable/c/a11dd49dcb9376776193e15641f84fcc1e5980c9"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Sparse-Memory/vmemmap out-of-bounds fix\n\nOffset vmemmap so that the first page of vmemmap will be mapped\nto the first page of physical memory in order to ensure that\nvmemmap\u2019s bounds will be respected during\npfn_to_page()/page_to_pfn() operations.\nThe conversion macros will produce correct SV39/48/57 addresses\nfor every possible/valid DRAM_BASE inside the physical memory limits.\n\nv2:Address Alex's comments"}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-05T09:15:58.089Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26795", "state": "PUBLISHED", "dateUpdated": "2024-11-05T09:15:58.089Z", "dateReserved": "2024-02-19T14:20:24.178Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-04T08:20:25.063Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: riscv: Sparse-Memory/vmemmap out-of-bounds fix", "id": "2273440", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2273440"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nriscv: Sparse-Memory/vmemmap out-of-bounds fix\nOffset vmemmap so that the first page of vmemmap will be mapped\nto the first page of physical memory in order to ensure that\nvmemmap\u2019s bounds will be respected during\npfn_to_page()/page_to_pfn() operations.\nThe conversion macros will produce correct SV39/48/57 addresses\nfor every possible/valid DRAM_BASE inside the physical memory limits.\nv2:Address Alex's comments", "An out-of-bounds vulnerability was found in the Sparse-Memory/vmemmap handling for RISC-V architectures in the Linux kernel. This issue potentially leads to memory corruption or unintended behavior."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-26795", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26795\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26795\nhttps://lore.kernel.org/linux-cve-announce/2024040402-CVE-2024-26795-404a@gregkh/T"], "statement": "Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.", "threat_severity": "Moderate", "upstream_fix": "kernel 5.10.212, kernel 5.15.151, kernel 6.1.81, kernel 6.6.21, kernel 6.7.9, kernel 6.8"}