UBUNTU-CVE-2024-40948
In the Linux kernel, the following vulnerability has been resolved: mm/page_table_check: fix crash on ZONE_DEVICE Not all pages may apply to pgtable check. One example is ZONE_DEVICE pages: they map PFNs directly, and they don't allocate page_ext at all even if there's struct page around. One may reference devm_memremap_pages(). When both ZONE_DEVICE and page-table-check enabled, then try to map some dax memories, one can trigger kernel bug constantly now when the kernel was trying to inject some pfn maps on the dax device: kernel BUG at mm/page_table_check.c:55! While it's pretty legal to use set_pxx_at() for ZONE_DEVICE pages for page fault resolutions, skip all the checks if page_ext doesn't even exist in pgtable checker, which applies to ZONE_DEVICE but maybe more.
02 / AFFECTED SOFTWARE
Affected packages
4 explicit affected versions
8 explicit affected versions
29 explicit affected versions
10 explicit affected versions
12 explicit affected versions
11 explicit affected versions
1 explicit affected versions
2 explicit affected versions
7 explicit affected versions
26 explicit affected versions
37 explicit affected versions
10 explicit affected versions
10 explicit affected versions
13 explicit affected versions
13 explicit affected versions
9 explicit affected versions
5 explicit affected versions
37 explicit affected versions
8 explicit affected versions
4 explicit affected versions
8 explicit affected versions
19 explicit affected versions
23 explicit affected versions
7 explicit affected versions
10 explicit affected versions
33 explicit affected versions
16 explicit affected versions
13 explicit affected versions
11 explicit affected versions
12 explicit affected versions
38 explicit affected versions
12 explicit affected versions
6 explicit affected versions
51 explicit affected versions
13 explicit affected versions
12 explicit affected versions
10 explicit affected versions
10 explicit affected versions
13 explicit affected versions
4 explicit affected versions
11 explicit affected versions
1 explicit affected versions
10 explicit affected versions
8 explicit affected versions
13 explicit affected versions
21 explicit affected versions
6 explicit affected versions
13 explicit affected versions
12 explicit affected versions
7 explicit affected versions
14 explicit affected versions
10 explicit affected versions
12 explicit affected versions
26 explicit affected versions
9 explicit affected versions
23 explicit affected versions
9 explicit affected versions
14 explicit affected versions
5 explicit affected versions
5 explicit affected versions
3 explicit affected versions
3 explicit affected versions
26 explicit affected versions
12 explicit affected versions
44 explicit affected versions
4 explicit affected versions
4 explicit affected versions
13 explicit affected versions
16 explicit affected versions
9 explicit affected versions
12 explicit affected versions
13 explicit affected versions
7 explicit affected versions
11 explicit affected versions
3 explicit affected versions
13 explicit affected versions
7 explicit affected versions
10 explicit affected versions
14 explicit affected versions
7 explicit affected versions
18 explicit affected versions
3 explicit affected versions
16 explicit affected versions
43 explicit affected versions
4 explicit affected versions
11 explicit affected versions
5 explicit affected versions
35 explicit affected versions
12 explicit affected versions
13 explicit affected versions
6 explicit affected versions
12 explicit affected versions
50 explicit affected versions
11 explicit affected versions
12 explicit affected versions
27 explicit affected versions
12 explicit affected versions
7 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: mm/page_table_check: fix crash on ZONE_DEVICE Not all pages may apply to pgtable check. One example is ZONE_DEVICE pages: they map PFNs directly, and they don't allocate page_ext at all even if there's struct page around. One may reference devm_memremap_pages(). When both ZONE_DEVICE and page-table-check enabled, then try to map some dax memories, one can trigger kernel bug constantly now when the kernel was trying to inject some pfn maps on the dax device: kernel BUG at mm/page_table_check.c:55! While it's pretty legal to use set_pxx_at() for ZONE_DEVICE pages for page fault resolutions, skip all the checks if page_ext doesn't even exist in pgtable checker, which applies to ZONE_DEVICE but maybe more.
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/8bb592c2eca8fd2bc06db7d80b38da18da4a2f43
- https://git.kernel.org/stable/c/51897f99351fff7b57f4f141940fa93b4e90fd2b
- https://git.kernel.org/stable/c/84d3549d54f5ff9fa3281257be3019386f51d1a0
- https://git.kernel.org/stable/c/8bb592c2eca8fd2bc06db7d80b38da18da4a2f43
- https://git.kernel.org/stable/c/dec2382247860d2134c8d41e103e26460c099629
- https://ubuntu.com/security/CVE-2024-40948
- https://ubuntu.com/security/notices/USN-6999-1
- https://ubuntu.com/security/notices/USN-6999-2
- https://ubuntu.com/security/notices/USN-7004-1
- https://ubuntu.com/security/notices/USN-7005-1
- https://ubuntu.com/security/notices/USN-7005-2
- https://ubuntu.com/security/notices/USN-7008-1
- https://ubuntu.com/security/notices/USN-7029-1
- https://www.cve.org/CVERecord?id=CVE-2024-40948