CVE-2024-41032 mm: vmalloc: check if a hash-index is in cpu_possible_mask
A missing check in the Linux kernel vmalloc subsystem causes a null pointer dereference and system crash on SPARC architectures with sparse CPU masks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41032?
CVE-2024-41032 is a high-severity vulnerability in Linux kernel, published on 29 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm: vmalloc: check if a hash-index is in cpu_possible_mask
The problem is that there are systems where cpu_possible_mask has gaps between set CPUs, for example SPARC. In this scenario addr_to_vb_xa() hash function can return an index which accesses to not-possible and not setup CPU area using per_cpu() macro. This results in an oops on SPARC.
A per-cpu vmap_block_queue is also used as hash table, incorrectly assuming the cpu_possible_mask has no gaps. Fix it by adjusting an index to a next possible CPU.
Which versions are affected by CVE-2024-41032?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-41032?
Apply the vendor's patch.
Is CVE-2024-41032 being exploited?
There is no known exploitation of CVE-2024-41032 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-41032, DEBIAN-CVE-2024-41032, GHSA-9gjm-j93v-m992, UBUNTU-CVE-2024-41032.