CVE-2024-56617 (GCVE-0-2024-56617)
Vulnerability from cvelistv5
Published
2024-12-27 14:51
Modified
2025-05-04 09:59
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU Commit 5944ce092b97 ("arch_topology: Build cacheinfo from primary CPU") adds functionality that architectures can use to optionally allocate and build cacheinfo early during boot. Commit 6539cffa9495 ("cacheinfo: Add arch specific early level initializer") lets secondary CPUs correct (and reallocate memory) cacheinfo data if needed. If the early build functionality is not used and cacheinfo does not need correction, memory for cacheinfo is never allocated. x86 does not use the early build functionality. Consequently, during the cacheinfo CPU hotplug callback, last_level_cache_is_valid() attempts to dereference a NULL pointer: BUG: kernel NULL pointer dereference, address: 0000000000000100 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not present page PGD 0 P4D 0 Oops: 0000 [#1] PREEPMT SMP NOPTI CPU: 0 PID 19 Comm: cpuhp/0 Not tainted 6.4.0-rc2 #1 RIP: 0010: last_level_cache_is_valid+0x95/0xe0a Allocate memory for cacheinfo during the cacheinfo CPU hotplug callback if not done earlier. Moreover, before determining the validity of the last-level cache info, ensure that it has been allocated. Simply checking for non-zero cache_leaves() is not sufficient, as some architectures (e.g., Intel processors) have non-zero cache_leaves() before allocation. Dereferencing NULL cacheinfo can occur in update_per_cpu_data_slice_size(). This function iterates over all online CPUs. However, a CPU may have come online recently, but its cacheinfo may not have been allocated yet. While here, remove an unnecessary indentation in allocate_cache_info(). [ bp: Massage. ]
Impacted products
Vendor Product Version
Linux Linux Version: 6539cffa94957241c096099a57d05fa4d8c7db8a
Version: 6539cffa94957241c096099a57d05fa4d8c7db8a
Version: 6539cffa94957241c096099a57d05fa4d8c7db8a
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/cacheinfo.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "23b5908b11b77ff8d7b8f7b8f11cbab2e1f4bfc2",
              "status": "affected",
              "version": "6539cffa94957241c096099a57d05fa4d8c7db8a",
              "versionType": "git"
            },
            {
              "lessThan": "95e197354e0de07e9a20819bdae6562e4dda0f20",
              "status": "affected",
              "version": "6539cffa94957241c096099a57d05fa4d8c7db8a",
              "versionType": "git"
            },
            {
              "lessThan": "b3fce429a1e030b50c1c91351d69b8667eef627b",
              "status": "affected",
              "version": "6539cffa94957241c096099a57d05fa4d8c7db8a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/cacheinfo.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU\n\nCommit\n\n  5944ce092b97 (\"arch_topology: Build cacheinfo from primary CPU\")\n\nadds functionality that architectures can use to optionally allocate and\nbuild cacheinfo early during boot. Commit\n\n  6539cffa9495 (\"cacheinfo: Add arch specific early level initializer\")\n\nlets secondary CPUs correct (and reallocate memory) cacheinfo data if\nneeded.\n\nIf the early build functionality is not used and cacheinfo does not need\ncorrection, memory for cacheinfo is never allocated. x86 does not use\nthe early build functionality. Consequently, during the cacheinfo CPU\nhotplug callback, last_level_cache_is_valid() attempts to dereference\na NULL pointer:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000100\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not present page\n  PGD 0 P4D 0\n  Oops: 0000 [#1] PREEPMT SMP NOPTI\n  CPU: 0 PID 19 Comm: cpuhp/0 Not tainted 6.4.0-rc2 #1\n  RIP: 0010: last_level_cache_is_valid+0x95/0xe0a\n\nAllocate memory for cacheinfo during the cacheinfo CPU hotplug callback\nif not done earlier.\n\nMoreover, before determining the validity of the last-level cache info,\nensure that it has been allocated. Simply checking for non-zero\ncache_leaves() is not sufficient, as some architectures (e.g., Intel\nprocessors) have non-zero cache_leaves() before allocation.\n\nDereferencing NULL cacheinfo can occur in update_per_cpu_data_slice_size().\nThis function iterates over all online CPUs. However, a CPU may have come\nonline recently, but its cacheinfo may not have been allocated yet.\n\nWhile here, remove an unnecessary indentation in allocate_cache_info().\n\n  [ bp: Massage. ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T09:59:59.495Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/23b5908b11b77ff8d7b8f7b8f11cbab2e1f4bfc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/95e197354e0de07e9a20819bdae6562e4dda0f20"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3fce429a1e030b50c1c91351d69b8667eef627b"
        }
      ],
      "title": "cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56617",
    "datePublished": "2024-12-27T14:51:21.869Z",
    "dateReserved": "2024-12-27T14:03:06.014Z",
    "dateUpdated": "2025-05-04T09:59:59.495Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56617\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:21.227\",\"lastModified\":\"2025-01-16T16:13:18.913\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU\\n\\nCommit\\n\\n  5944ce092b97 (\\\"arch_topology: Build cacheinfo from primary CPU\\\")\\n\\nadds functionality that architectures can use to optionally allocate and\\nbuild cacheinfo early during boot. Commit\\n\\n  6539cffa9495 (\\\"cacheinfo: Add arch specific early level initializer\\\")\\n\\nlets secondary CPUs correct (and reallocate memory) cacheinfo data if\\nneeded.\\n\\nIf the early build functionality is not used and cacheinfo does not need\\ncorrection, memory for cacheinfo is never allocated. x86 does not use\\nthe early build functionality. Consequently, during the cacheinfo CPU\\nhotplug callback, last_level_cache_is_valid() attempts to dereference\\na NULL pointer:\\n\\n  BUG: kernel NULL pointer dereference, address: 0000000000000100\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not present page\\n  PGD 0 P4D 0\\n  Oops: 0000 [#1] PREEPMT SMP NOPTI\\n  CPU: 0 PID 19 Comm: cpuhp/0 Not tainted 6.4.0-rc2 #1\\n  RIP: 0010: last_level_cache_is_valid+0x95/0xe0a\\n\\nAllocate memory for cacheinfo during the cacheinfo CPU hotplug callback\\nif not done earlier.\\n\\nMoreover, before determining the validity of the last-level cache info,\\nensure that it has been allocated. Simply checking for non-zero\\ncache_leaves() is not sufficient, as some architectures (e.g., Intel\\nprocessors) have non-zero cache_leaves() before allocation.\\n\\nDereferencing NULL cacheinfo can occur in update_per_cpu_data_slice_size().\\nThis function iterates over all online CPUs. However, a CPU may have come\\nonline recently, but its cacheinfo may not have been allocated yet.\\n\\nWhile here, remove an unnecessary indentation in allocate_cache_info().\\n\\n  [ bp: Massage. ]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cacheinfo: Asignar memoria durante la conexi\u00f3n en caliente de la CPU si no se hace desde la CPU principal. el commit 5944ce092b97 (\\\"arch_topology: Generar cacheinfo desde la CPU principal\\\") a\u00f1ade una funcionalidad que las arquitecturas pueden utilizar para asignar y generar opcionalmente cacheinfo de forma temprana durante el arranque. el commit 6539cffa9495 (\\\"cacheinfo: A\u00f1adir inicializador de nivel temprano espec\u00edfico de la arquitectura\\\") permite que las CPU secundarias corrijan (y reasignen memoria) los datos de cacheinfo si es necesario. Si no se utiliza la funcionalidad de generaci\u00f3n temprana y cacheinfo no necesita correcci\u00f3n, nunca se asigna memoria para cacheinfo. x86 no utiliza la funcionalidad de generaci\u00f3n temprana. En consecuencia, durante la devoluci\u00f3n de llamada hotplug de CPU de cacheinfo, last_level_cache_is_valid() intenta desreferenciar un puntero NULL: BUG: kernel NULL pointer dereference, address: 0000000000000100 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not present page PGD 0 P4D 0 Oops: 0000 [#1] PREEPMT SMP NOPTI CPU: 0 PID 19 Comm: cpuhp/0 Not tainted 6.4.0-rc2 #1 RIP: 0010: last_level_cache_is_valid+0x95/0xe0a Asigne memoria para cacheinfo durante la devoluci\u00f3n de llamada hotplug de CPU de cacheinfo si no se hizo antes. Adem\u00e1s, antes de determinar la validez de la informaci\u00f3n de cach\u00e9 de \u00faltimo nivel, aseg\u00farese de que se haya asignado. No basta con comprobar si hay cache_leaves() distintos de cero, ya que algunas arquitecturas (por ejemplo, los procesadores Intel) tienen cache_leaves() distintos de cero antes de la asignaci\u00f3n. La anulaci\u00f3n de referencias a cacheinfo NULL puede ocurrir en update_per_cpu_data_slice_size(). Esta funci\u00f3n itera sobre todas las CPU en l\u00ednea. Sin embargo, es posible que una CPU se haya conectado recientemente, pero que su cacheinfo a\u00fan no se haya asignado. Mientras est\u00e9 aqu\u00ed, elimine una sangr\u00eda innecesaria en allocate_cache_info(). [ bp: Masaje. ]\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4\",\"versionEndExcluding\":\"6.6.66\",\"matchCriteriaId\":\"26B700EE-A79C-4047-8214-099FACC0BEB5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.5\",\"matchCriteriaId\":\"9501D045-7A94-42CA-8B03-821BE94A65B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/23b5908b11b77ff8d7b8f7b8f11cbab2e1f4bfc2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/95e197354e0de07e9a20819bdae6562e4dda0f20\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b3fce429a1e030b50c1c91351d69b8667eef627b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…