{"vulnerability": "CVE-2024-42243", "sightings": [{"uuid": "e0badda3-6364-41bd-9ca7-350b2720068a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-42243", "type": "published-proof-of-concept", "source": "https://t.me/cvedetector/2704", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-42243 - Linux Kernel Linux Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-42243 \nPublished : Aug. 7, 2024, 4:15 p.m. | 15\u00a0minutes ago \nDescription : In the Linux kernel, the following vulnerability has been resolved:  \n  \nmm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray  \n  \nPatch series \"mm/filemap: Limit page cache size to that supported by  \nxarray\", v2.  \n  \nCurrently, xarray can't support arbitrary page cache size.  More details  \ncan be found from the WARN_ON() statement in xas_split_alloc().  In our  \ntest whose code is attached below, we hit the WARN_ON() on ARM64 system  \nwhere the base page size is 64KB and huge page size is 512MB.  The issue  \nwas reported long time ago and some discussions on it can be found here  \n[1].  \n  \n[1]   \n  \nIn order to fix the issue, we need to adjust MAX_PAGECACHE_ORDER to one  \nsupported by xarray and avoid PMD-sized page cache if needed.  The code  \nchanges are suggested by David Hildenbrand.  \n  \nPATCH[1] adjusts MAX_PAGECACHE_ORDER to that supported by xarray  \nPATCH[2-3] avoids PMD-sized page cache in the synchronous readahead path  \nPATCH[4] avoids PMD-sized page cache for shmem files if needed  \n  \nTest program  \n============  \n# cat test.c  \n#define _GNU_SOURCE  \n#include   \n#include   \n#include   \n#include   \n#include   \n#include   \n#include   \n#include   \n  \n#define TEST_XFS_FILENAME \"/tmp/data\"  \n#define TEST_SHMEM_FILENAME \"/dev/shm/data\"  \n#define TEST_MEM_SIZE  0x20000000  \n  \nint main(int argc, char **argv)  \n{  \n const char *filename;  \n int fd = 0;  \n void *buf = (void *)-1, *p;  \n int pgsize = getpagesize();  \n int ret;  \n  \n if (pgsize != 0x10000) {  \n  fprintf(stderr, \"64KB base page size is required\\n\");  \n  return -EPERM;  \n }  \n  \n system(\"echo force > /sys/kernel/mm/transparent_hugepage/shmem_enabled\");  \n system(\"rm -fr /tmp/data\");  \n system(\"rm -fr /dev/shm/data\");  \n system(\"echo 1 > /proc/sys/vm/drop_caches\");  \n  \n /* Open xfs or shmem file */  \n filename = TEST_XFS_FILENAME;  \n if (argc > 1 && !strcmp(argv[1], \"shmem\"))  \n  filename = TEST_SHMEM_FILENAME;  \n  \n fd = open(filename, O_CREAT | O_RDWR | O_TRUNC);  \n if (fd \\n\", filename);  \n  return -EIO;  \n }  \n  \n /* Extend file size */  \n ret = ftruncate(fd, TEST_MEM_SIZE);  \n if (ret) {  \n  fprintf(stderr, \"Error %d to ftruncate()\\n\", ret);  \n  goto cleanup;  \n }  \n  \n /* Create VMA */  \n buf = mmap(NULL, TEST_MEM_SIZE,  \n     PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);  \n if (buf == (void *)-1) {  \n  fprintf(stderr, \"Unable to mmap \\n\", filename);  \n  goto cleanup;  \n }  \n  \n fprintf(stdout, \"mapped buffer at 0x%p\\n\", buf);  \n ret = madvise(buf, TEST_MEM_SIZE, MADV_HUGEPAGE);  \n        if (ret) {  \n  fprintf(stderr, \"Unable to madvise(MADV_HUGEPAGE)\\n\");  \n  goto cleanup;  \n }  \n  \n /* Populate VMA */  \n ret = madvise(buf, TEST_MEM_SIZE, MADV_POPULATE_WRITE);  \n if (ret) {  \n  fprintf(stderr, \"Error %d to madvise(MADV_POPULATE_WRITE)\\n\", ret);  \n  goto cleanup;  \n }  \n  \n /* Punch the file to enforce xarray split */  \n ret = fallocate(fd, FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE,  \n          TEST_MEM_SIZE - pgsize, pgsize);  \n if (ret)  \n  fprintf(stderr, \"Error %d to fallocate()\\n\", ret);  \n  \ncleanup:  \n if (buf != (void *)-1)  \n  munmap(buf, TEST_MEM_SIZE);  \n if (fd > 0)  \n  close(fd);  \n  \n return 0;  \n}  \n  \n# gcc test.c -o test  \n# cat /proc/1/smaps | grep KernelPageSize | head -n 1  \nKernelPageSize:       64 kB  \n# ./test shmem  \n   :  \n------------[ cut here ]------------  \nWARNING: CPU: 17 PID: 5253 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128  \nModules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib  \\  \nnft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct    \\  \nnft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4    \\  \nip_set nf_tables rfkill nfnetlink vfat fat virtio_balloon          \\  \ndrm fuse xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64  \\  \nvirtio_net sha1_ce net_failover failover virtio_console virtio_blk \\  \ndimlib virtio_mmi[...]", "creation_timestamp": "2024-08-07T18:38:41.000000Z"}]}