CVE-2024-26712

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
03/04/2024
Last modified:
08/04/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> powerpc/kasan: Fix addr error caused by page alignment<br /> <br /> In kasan_init_region, when k_start is not page aligned, at the begin of<br /> for loop, k_cur = k_start &amp; PAGE_MASK is less than k_start, and then<br /> `va = block + k_cur - k_start` is less than block, the addr va is invalid,<br /> because the memory address space from va to block is not alloced by<br /> memblock_alloc, which will not be reserved by memblock_reserve later, it<br /> will be used by other places.<br /> <br /> As a result, memory overwriting occurs.<br /> <br /> for example:<br /> int __init __weak kasan_init_region(void *start, size_t size)<br /> {<br /> [...]<br /> /* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */<br /> block = memblock_alloc(k_end - k_start, PAGE_SIZE);<br /> [...]<br /> for (k_cur = k_start &amp; PAGE_MASK; k_cur

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.4 (including) 5.10.210 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.149 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 6.1.79 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.18 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.7.6 (excluding)
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*