CVE-2024-57881 mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy()
A null pointer dereference in the Linux kernel memory allocator can cause a system crash when freeing specific high-memory pages under sparse memory configurations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-57881?
CVE-2024-57881 is a medium-severity vulnerability in Linux kernel, published on 11 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy()
In split_large_buddy(), we might call pfn_to_page() on a PFN that might not exist. In corner cases, such as when freeing the highest pageblock in the last memory section, this could result with CONFIG_SPARSEMEM && !CONFIG_SPARSEMEM_EXTREME in __pfn_to_section() returning NULL and and __section_mem_map_addr() dereferencing that NULL pointer.
Let's fix it, and avoid doing a pfn_to_page() call for the first iteration, where we already have the page.
So far this was found by code inspection, but let's just CC stable as the fix is easy.
Weakness: CWE-476
Which versions are affected by CVE-2024-57881?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-57881?
Apply the vendor's patch.
Is CVE-2024-57881 being exploited?
There is no known exploitation of CVE-2024-57881 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-57881, DEBIAN-CVE-2024-57881, GHSA-7x5p-5275-mmvg, UBUNTU-CVE-2024-57881.