CVE-2024-39277 dma-mapping: benchmark: handle NUMA_NO_NODE correctly
A local attacker can trigger a kernel crash via an out-of-bounds array access in the DMA mapping benchmark when handling NUMA_NO_NODE.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-39277?
CVE-2024-39277 is a high-severity vulnerability in Linux kernel, published on 21 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
dma-mapping: benchmark: handle NUMA_NO_NODE correctly
cpumask_of_node() can be called for NUMA_NO_NODE inside do_map_benchmark() resulting in the following sanitizer report:
UBSAN: array-index-out-of-bounds in ./arch/x86/include/asm/topology.h:72:28 index -1 is out of range for type 'cpumask [64][1]' CPU: 1 PID: 990 Comm: dma_map_benchma Not tainted 6.9.0-rc6 #29 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:117) ubsan_epilogue (lib/ubsan.c:232) __ubsan_handle_out_of_bounds (lib/ubsan.c:429) cpumask_of_node (arch/x86/include/asm/topology.h:72) [inline] do_map_benchmark (kernel/dma/map_benchmark.c:104) map_benchmark_ioctl (kernel/dma/map_benchmark.c:246) full_proxy_unlocked_ioctl (fs/debugfs/file.c:333) __x64_sys_ioctl (fs/ioctl.c:890) do_syscall_64 (arch/x86/entry/common.c:83) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
Use cpumask_of_node() in place when binding a kernel thread to a cpuset of a particular node.
Note that the provided node id is checked inside map_benchmark_ioctl(). It's just a NUMA_NO_NODE case which is not handled properly later.
Found by Linux Verification Center (linuxtesting.org).
Weakness: CWE-125
Which versions are affected by CVE-2024-39277?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-39277?
Apply the vendor's patch.
Is CVE-2024-39277 being exploited?
There is no known exploitation of CVE-2024-39277 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-42838, AZL-42844, BELL-CVE-2024-39277, DEBIAN-CVE-2024-39277, GHSA-vjh2-m3m9-vp7g, UBUNTU-CVE-2024-39277.