UBUNTU-CVE-2024-26675
In the Linux kernel, the following vulnerability has been resolved: ppp_async: limit MRU to 64K syzbot triggered a warning [1] in __alloc_pages(): WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp) Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K") Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU) [1]: WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 Modules linked in: CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: events_unbound flush_to_ldisc pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537 sp : ffff800093967580 x29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000 x26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0 x23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8 x20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120 x17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005 x14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000 x11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001 x8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f x5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020 x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0 Call trace: __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926 __do_kmalloc_node mm/slub.c:3969 [inline] __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001 kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590 __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651 __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715 netdev_alloc_skb include/linux/skbuff.h:3235 [inline] dev_alloc_skb include/linux/skbuff.h:3248 [inline] ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline] ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341 tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390 tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:444 [inline] flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494 process_one_work+0x694/0x1204 kernel/workqueue.c:2633 process_scheduled_works kernel/workqueue.c:2706 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
02 / AFFECTED SOFTWARE
Affected packages
50 explicit affected versions
6 explicit affected versions
12 explicit affected versions
18 explicit affected versions
6 explicit affected versions
50 explicit affected versions
36 explicit affected versions
57 explicit affected versions
47 explicit affected versions
36 explicit affected versions
10 explicit affected versions
43 explicit affected versions
191 explicit affected versions
7 explicit affected versions
44 explicit affected versions
84 explicit affected versions
11 explicit affected versions
66 explicit affected versions
35 explicit affected versions
3 explicit affected versions
14 explicit affected versions
18 explicit affected versions
5 explicit affected versions
97 explicit affected versions
30 explicit affected versions
86 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
102 explicit affected versions
1 explicit affected versions
21 explicit affected versions
9 explicit affected versions
16 explicit affected versions
10 explicit affected versions
41 explicit affected versions
7 explicit affected versions
12 explicit affected versions
34 explicit affected versions
12 explicit affected versions
12 explicit affected versions
7 explicit affected versions
74 explicit affected versions
12 explicit affected versions
89 explicit affected versions
97 explicit affected versions
12 explicit affected versions
85 explicit affected versions
10 explicit affected versions
10 explicit affected versions
168 explicit affected versions
37 explicit affected versions
101 explicit affected versions
11 explicit affected versions
10 explicit affected versions
23 explicit affected versions
1 explicit affected versions
27 explicit affected versions
26 explicit affected versions
13 explicit affected versions
4 explicit affected versions
1 explicit affected versions
29 explicit affected versions
78 explicit affected versions
13 explicit affected versions
47 explicit affected versions
1 explicit affected versions
73 explicit affected versions
45 explicit affected versions
89 explicit affected versions
7 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
95 explicit affected versions
11 explicit affected versions
12 explicit affected versions
118 explicit affected versions
7 explicit affected versions
12 explicit affected versions
88 explicit affected versions
2 explicit affected versions
36 explicit affected versions
28 explicit affected versions
111 explicit affected versions
44 explicit affected versions
131 explicit affected versions
10 explicit affected versions
26 explicit affected versions
23 explicit affected versions
1 explicit affected versions
13 explicit affected versions
118 explicit affected versions
47 explicit affected versions
16 explicit affected versions
47 explicit affected versions
37 explicit affected versions
3 explicit affected versions
72 explicit affected versions
1 explicit affected versions
2 explicit affected versions
54 explicit affected versions
51 explicit affected versions
71 explicit affected versions
1 explicit affected versions
12 explicit affected versions
34 explicit affected versions
27 explicit affected versions
20 explicit affected versions
1 explicit affected versions
1 explicit affected versions
75 explicit affected versions
8 explicit affected versions
8 explicit affected versions
5 explicit affected versions
8 explicit affected versions
1 explicit affected versions
10 explicit affected versions
11 explicit affected versions
77 explicit affected versions
13 explicit affected versions
41 explicit affected versions
7 explicit affected versions
73 explicit affected versions
39 explicit affected versions
10 explicit affected versions
12 explicit affected versions
12 explicit affected versions
76 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
33 explicit affected versions
37 explicit affected versions
12 explicit affected versions
38 explicit affected versions
37 explicit affected versions
9 explicit affected versions
36 explicit affected versions
11 explicit affected versions
145 explicit affected versions
44 explicit affected versions
8 explicit affected versions
7 explicit affected versions
18 explicit affected versions
78 explicit affected versions
48 explicit affected versions
122 explicit affected versions
101 explicit affected versions
4 explicit affected versions
1 explicit affected versions
1 explicit affected versions
42 explicit affected versions
94 explicit affected versions
11 explicit affected versions
43 explicit affected versions
42 explicit affected versions
125 explicit affected versions
145 explicit affected versions
10 explicit affected versions
8 explicit affected versions
14 explicit affected versions
77 explicit affected versions
4 explicit affected versions
66 explicit affected versions
9 explicit affected versions
1 explicit affected versions
48 explicit affected versions
9 explicit affected versions
29 explicit affected versions
41 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: ppp_async: limit MRU to 64K syzbot triggered a warning [1] in __alloc_pages(): WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp) Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K") Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU) [1]: WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 Modules linked in: CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: events_unbound flush_to_ldisc pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537 sp : ffff800093967580 x29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000 x26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0 x23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8 x20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120 x17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005 x14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000 x11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001 x8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f x5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020 x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0 Call trace: __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926 __do_kmalloc_node mm/slub.c:3969 [inline] __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001 kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590 __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651 __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715 netdev_alloc_skb include/linux/skbuff.h:3235 [inline] dev_alloc_skb include/linux/skbuff.h:3248 [inline] ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline] ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341 tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390 tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:444 [inline] flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494 process_one_work+0x694/0x1204 kernel/workqueue.c:2633 process_scheduled_works kernel/workqueue.c:2706 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/cb88cb53badb8aeb3955ad6ce80b07b598e310b8
- https://git.kernel.org/stable/c/210d938f963dddc543b07e66a79b7d8d4bd00bd8
- https://git.kernel.org/stable/c/4e2c4846b2507f6dfc9bea72b7567c2693a82a16
- https://git.kernel.org/stable/c/4fdb14ba89faff6e6969a4dffdc8e54235d6e5ed
- https://git.kernel.org/stable/c/56fae81633ccee307cfcb032f706bf1863a56982
- https://git.kernel.org/stable/c/58fbe665b097bf7b3144da7e7b91fb27aa8d0ae3
- https://git.kernel.org/stable/c/7e5ef49670766c9742ffcd9cead7cdb018268719
- https://git.kernel.org/stable/c/b06e067e93fa4b98acfd3a9f38a398ab91bbc58b
- https://git.kernel.org/stable/c/cb88cb53badb8aeb3955ad6ce80b07b598e310b8
- https://ubuntu.com/security/CVE-2024-26675
- https://ubuntu.com/security/notices/USN-6766-1
- https://ubuntu.com/security/notices/USN-6766-2
- https://ubuntu.com/security/notices/USN-6766-3
- https://ubuntu.com/security/notices/USN-6767-1
- https://ubuntu.com/security/notices/USN-6767-2
- https://ubuntu.com/security/notices/USN-6795-1
- https://ubuntu.com/security/notices/USN-6828-1
- https://ubuntu.com/security/notices/USN-6895-1
- https://ubuntu.com/security/notices/USN-6895-2
- https://ubuntu.com/security/notices/USN-6895-3
- https://ubuntu.com/security/notices/USN-6895-4
- https://ubuntu.com/security/notices/USN-6900-1
- https://ubuntu.com/security/notices/USN-7121-1
- https://ubuntu.com/security/notices/USN-7121-2
- https://ubuntu.com/security/notices/USN-7121-3
- https://ubuntu.com/security/notices/USN-7148-1
- https://www.cve.org/CVERecord?id=CVE-2024-26675