{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-46852", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-11T15:12:18.290Z", "datePublished": "2024-09-27T12:42:45.336Z", "dateUpdated": "2026-08-05T11:39:01.066Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:39:01.066Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf: heaps: Fix off-by-one in CMA heap fault handler\n\nUntil VM_DONTEXPAND was added in commit 1c1914d6e8c6 (\"dma-buf: heaps:\nDon't track CMA dma-buf pages under RssFile\") it was possible to obtain\na mapping larger than the buffer size via mremap and bypass the overflow\ncheck in dma_buf_mmap_internal. When using such a mapping to attempt to\nfault past the end of the buffer, the CMA heap fault handler also checks\nthe fault offset against the buffer size, but gets the boundary wrong by\n1. Fix the boundary check so that we don't read off the end of the pages\narray and insert an arbitrary page in the mapping." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires local access to the `/dev/dma_heap/` character device, an ioctl to allocate the buffer, and mmap/mremap/page-fault activity from a local process. No network or physical component is involved.\nAC:L - The off-by-one is deterministic — allocate a buffer, mmap it at full size, grow it with mremap (unblocked before v6.8), then touch the page at offset `pagecount`. Buffer size is attacker-chosen, so the slab layout used to control the adjacent `struct page *` can be groomed reliably.\nPR:L - No capability check exists anywhere on the path (`dma_heap_open`/`dma_heap_ioctl_allocate`/`cma_heap_allocate`); only DAC permission on the heap device node is needed, which on the dominant deployment for CMA heaps (Android/embedded ARM) is granted to ordinary unprivileged app and media processes.\nUI:N - The attacking process performs every step itself — open, ioctl, mmap, mremap, memory access. No victim action or cooperation is required.\nS:U - The corruption and the resulting privilege gain are entirely within the kernel's own security authority; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - Beyond the 8-byte out-of-bounds slab read, the handler installs the forged `struct page` into the faulting process's page tables, giving userspace a direct read mapping of an arbitrary physical page — arbitrary kernel and cross-process memory disclosure.\nI:H - The VMA is `MAP_SHARED` with no `page_mkwrite`, so `finish_fault()` installs a writable PTE for the arbitrary page, yielding an arbitrary physical-memory write; `get_page()` additionally increments a refcount at an attacker-influenced address. Both are readily leveraged into control-flow hijack and root.\nA:H - Dereferencing an out-of-bounds `struct page *` and inserting a bogus PFN into a mapping causes oops/panic and refcount corruption of unrelated pages, and the attacker can repeat it at will." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/dma-buf/heaps/cma_heap.c" ], "versions": [ { "version": "a5d2d29e24be8967ef78a1b1fb2292413e3b3df9", "lessThan": "79cce5e81d20fa9ad553be439d665ac3302d3c95", "status": "affected", "versionType": "git" }, { "version": "a5d2d29e24be8967ef78a1b1fb2292413e3b3df9", "lessThan": "84175dc5b2c932266a50c04e5ce342c30f817a2f", "status": "affected", "versionType": "git" }, { "version": "a5d2d29e24be8967ef78a1b1fb2292413e3b3df9", "lessThan": "eb7fc8b65cea22f9038c52398c8b22849e9620ea", "status": "affected", "versionType": "git" }, { "version": "a5d2d29e24be8967ef78a1b1fb2292413e3b3df9", "lessThan": "e79050882b857c37634baedbdcf7c2047c24cbff", "status": "affected", "versionType": "git" }, { "version": "a5d2d29e24be8967ef78a1b1fb2292413e3b3df9", "lessThan": "ea5ff5d351b520524019f7ff7f9ce418de2dad87", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/dma-buf/heaps/cma_heap.c" ], "versions": [ { "version": "5.11", "status": "affected" }, { "version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.111", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.52", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.11", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.111" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.52" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.10.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/79cce5e81d20fa9ad553be439d665ac3302d3c95" }, { "url": "https://git.kernel.org/stable/c/84175dc5b2c932266a50c04e5ce342c30f817a2f" }, { "url": "https://git.kernel.org/stable/c/eb7fc8b65cea22f9038c52398c8b22849e9620ea" }, { "url": "https://git.kernel.org/stable/c/e79050882b857c37634baedbdcf7c2047c24cbff" }, { "url": "https://git.kernel.org/stable/c/ea5ff5d351b520524019f7ff7f9ce418de2dad87" } ], "title": "dma-buf: heaps: Fix off-by-one in CMA heap fault handler", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2025-03-14T00:00:00+00:00", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2024-46852" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-15T03:55:23.131Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:19:37.416Z" } } ] } }