{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-42293", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-30T07:40:12.268Z", "datePublished": "2024-08-17T09:09:02.303Z", "dateUpdated": "2026-08-05T11:36:25.572Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:25.572Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: mm: Fix lockless walks with static and dynamic page-table folding\n\nLina reports random oopsen originating from the fast GUP code when\n16K pages are used with 4-level page-tables, the fourth level being\nfolded at runtime due to lack of LPA2.\n\nIn this configuration, the generic implementation of\np4d_offset_lockless() will return a 'p4d_t *' corresponding to the\n'pgd_t' allocated on the stack of the caller, gup_fast_pgd_range().\nThis is normally fine, but when the fourth level of page-table is folded\nat runtime, pud_offset_lockless() will offset from the address of the\n'p4d_t' to calculate the address of the PUD in the same page-table page.\nThis results in a stray stack read when the 'p4d_t' has been allocated\non the stack and can send the walker into the weeds.\n\nFix the problem by providing our own definition of p4d_offset_lockless()\nwhen CONFIG_PGTABLE_LEVELS <= 4 which returns the real page-table\npointer rather than the address of the local stack variable." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is reached via ordinary syscalls that invoke GUP-fast on `current->mm` (O_DIRECT read/write, io_uring, vmsplice, futex, process_vm_readv), and it walks the calling task's own kernel stack. This requires local code execution; there is no remote or adjacent trigger.\nAC:L - No race and no unpredictable state is needed — the stray stack read happens on every GUP-fast call in the affected configuration, and the attacker directly selects which 8-byte stack word is used as a PUD by choosing the user address (`pud_index(addr) = (addr >> 36) & 2047` covers the whole 16K stack). The vulnerable build (16K pages with the default 52-bit VA) plus non-LPA2 hardware is a real, widely shipped deployment (Asahi Linux, 16KB-page Android), and is not a condition the attacker must win.\nPR:L - Any unprivileged local user can call `pread()`/`pwrite()` on an O_DIRECT fd, `vmsplice()`, `futex()`, or io_uring to enter `gup_fast_fallback()`. No capability, namespace, or other access check exists on the path.\nUI:N - The attacker triggers the fault entirely through their own syscalls on their own address space; no victim action or cooperation is needed.\nS:U - The corruption and its consequences are confined to the kernel's own security authority — standard kernel memory corruption and privilege escalation, not a VM or IOMMU boundary crossing.\nC:H - Attacker-controlled kernel-stack words (including `pt_regs`-held user register values) are interpreted as PUD/PMD/PTE entries with no `pfn_valid()` check in production builds, so `pud_page()`/`pte_page()` returns a struct page for an arbitrary PFN that the caller then reads — an arbitrary physical memory read primitive (e.g. dumping kernel memory via an O_DIRECT write).\nI:H - The same fabricated page-table walk lets an O_DIRECT read or io_uring write target arbitrary physical pages, and `try_grab_folio()` performs a refcount increment on a struct page synthesized from a fully controlled 64-bit value, giving arbitrary write primitives suitable for control-flow hijacking and privilege escalation.\nA:H - The reporter observed random kernel oopsen from the fast GUP code in this configuration, and dereferencing garbage as page-table entries reliably produces kernel panics and refcount corruption." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/arm64/include/asm/pgtable.h" ], "versions": [ { "version": "0dd4f60a2c76938c2625f6c630c225699d97608b", "lessThan": "78672d49d3eebbcda3589f4d6e589caf357c5a59", "status": "affected", "versionType": "git" }, { "version": "0dd4f60a2c76938c2625f6c630c225699d97608b", "lessThan": "36639013b3462c06ff8e3400a427f775b4fc97f5", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/arm64/include/asm/pgtable.h" ], "versions": [ { "version": "6.9", "status": "affected" }, { "version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.3", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.10.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/78672d49d3eebbcda3589f4d6e589caf357c5a59" }, { "url": "https://git.kernel.org/stable/c/36639013b3462c06ff8e3400a427f775b4fc97f5" } ], "title": "arm64: mm: Fix lockless walks with static and dynamic page-table folding", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-42293", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:10:57.009784Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:29.368Z" } } ] } }