CVE-2024-44965 x86/mm: Fix pti_clone_pgtable() alignment assumption
A flaw in the Linux kernel's page table cloning logic causes system crashes on i386 architectures, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-44965?
CVE-2024-44965 is a medium-severity denial of service vulnerability in Linux kernel, published on 4 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
x86/mm: Fix pti_clone_pgtable() alignment assumption
Guenter reported dodgy crashes on an i386-nosmp build using GCC-11 that had the form of endless traps until entry stack exhaust and then #DF from the stack guard.
It turned out that pti_clone_pgtable() had alignment assumptions on the start address, notably it hard assumes start is PMD aligned. This is true on x86_64, but very much not true on i386.
These assumptions can cause the end condition to malfunction, leading to a 'short' clone. Guess what happens when the user mapping has a short copy of the entry text?
Use the correct increment form for addr to avoid alignment assumptions.
Which versions are affected by CVE-2024-44965?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-44965?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-44965 being exploited?
There is no known exploitation of CVE-2024-44965 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-44965, DEBIAN-CVE-2024-44965, GHSA-8px8-w879-9rmh, UBUNTU-CVE-2024-44965.