CVE-2024-56673 (GCVE-0-2024-56673)
Vulnerability from cvelistv5
Published
2024-12-27 15:06
Modified
2025-10-01 20:07
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Do not call pmd dtor on vmemmap page table teardown The vmemmap's, which is used for RV64 with SPARSEMEM_VMEMMAP, page tables are populated using pmd (page middle directory) hugetables. However, the pmd allocation is not using the generic mechanism used by the VMA code (e.g. pmd_alloc()), or the RISC-V specific create_pgd_mapping()/alloc_pmd_late(). Instead, the vmemmap page table code allocates a page, and calls vmemmap_set_pmd(). This results in that the pmd ctor is *not* called, nor would it make sense to do so. Now, when tearing down a vmemmap page table pmd, the cleanup code would unconditionally, and incorrectly call the pmd dtor, which results in a crash (best case). This issue was found when running the HMM selftests: | tools/testing/selftests/mm# ./test_hmm.sh smoke | ... # when unloading the test_hmm.ko module | page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10915b | flags: 0x1000000000000000(node=0|zone=1) | raw: 1000000000000000 0000000000000000 dead000000000122 0000000000000000 | raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 | page dumped because: VM_BUG_ON_PAGE(ptdesc->pmd_huge_pte) | ------------[ cut here ]------------ | kernel BUG at include/linux/mm.h:3080! | Kernel BUG [#1] | Modules linked in: test_hmm(-) sch_fq_codel fuse drm drm_panel_orientation_quirks backlight dm_mod | CPU: 1 UID: 0 PID: 514 Comm: modprobe Tainted: G W 6.12.0-00982-gf2a4f1682d07 #2 | Tainted: [W]=WARN | Hardware name: riscv-virtio qemu/qemu, BIOS 2024.10 10/01/2024 | epc : remove_pgd_mapping+0xbec/0x1070 | ra : remove_pgd_mapping+0xbec/0x1070 | epc : ffffffff80010a68 ra : ffffffff80010a68 sp : ff20000000a73940 | gp : ffffffff827b2d88 tp : ff6000008785da40 t0 : ffffffff80fbce04 | t1 : 0720072007200720 t2 : 706d756420656761 s0 : ff20000000a73a50 | s1 : ff6000008915cff8 a0 : 0000000000000039 a1 : 0000000000000008 | a2 : ff600003fff0de20 a3 : 0000000000000000 a4 : 0000000000000000 | a5 : 0000000000000000 a6 : c0000000ffffefff a7 : ffffffff824469b8 | s2 : ff1c0000022456c0 s3 : ff1ffffffdbfffff s4 : ff6000008915c000 | s5 : ff6000008915c000 s6 : ff6000008915c000 s7 : ff1ffffffdc00000 | s8 : 0000000000000001 s9 : ff1ffffffdc00000 s10: ffffffff819a31f0 | s11: ffffffffffffffff t3 : ffffffff8000c950 t4 : ff60000080244f00 | t5 : ff60000080244000 t6 : ff20000000a73708 | status: 0000000200000120 badaddr: ffffffff80010a68 cause: 0000000000000003 | [<ffffffff80010a68>] remove_pgd_mapping+0xbec/0x1070 | [<ffffffff80fd238e>] vmemmap_free+0x14/0x1e | [<ffffffff8032e698>] section_deactivate+0x220/0x452 | [<ffffffff8032ef7e>] sparse_remove_section+0x4a/0x58 | [<ffffffff802f8700>] __remove_pages+0x7e/0xba | [<ffffffff803760d8>] memunmap_pages+0x2bc/0x3fe | [<ffffffff02a3ca28>] dmirror_device_remove_chunks+0x2ea/0x518 [test_hmm] | [<ffffffff02a3e026>] hmm_dmirror_exit+0x3e/0x1018 [test_hmm] | [<ffffffff80102c14>] __riscv_sys_delete_module+0x15a/0x2a6 | [<ffffffff80fd020c>] do_trap_ecall_u+0x1f2/0x266 | [<ffffffff80fde0a2>] _new_vmalloc_restore_context_a0+0xc6/0xd2 | Code: bf51 7597 0184 8593 76a5 854a 4097 0029 80e7 2c00 (9002) 7597 | ---[ end trace 0000000000000000 ]--- | Kernel panic - not syncing: Fatal exception in interrupt Add a check to avoid calling the pmd dtor, if the calling context is vmemmap_free().
References
Impacted products
Vendor Product Version
Linux Linux Version: c75a74f4ba19c904c0ae1e011ae2568449409ae4
Version: c75a74f4ba19c904c0ae1e011ae2568449409ae4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56673",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:59:31.187588Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:07:08.957Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/mm/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "344945806f2f7af68be98bac02836c867f223aa9",
              "status": "affected",
              "version": "c75a74f4ba19c904c0ae1e011ae2568449409ae4",
              "versionType": "git"
            },
            {
              "lessThan": "21f1b85c8912262adf51707e63614a114425eb10",
              "status": "affected",
              "version": "c75a74f4ba19c904c0ae1e011ae2568449409ae4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/mm/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.6",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: mm: Do not call pmd dtor on vmemmap page table teardown\n\nThe vmemmap\u0027s, which is used for RV64 with SPARSEMEM_VMEMMAP, page\ntables are populated using pmd (page middle directory) hugetables.\nHowever, the pmd allocation is not using the generic mechanism used by\nthe VMA code (e.g. pmd_alloc()), or the RISC-V specific\ncreate_pgd_mapping()/alloc_pmd_late(). Instead, the vmemmap page table\ncode allocates a page, and calls vmemmap_set_pmd(). This results in\nthat the pmd ctor is *not* called, nor would it make sense to do so.\n\nNow, when tearing down a vmemmap page table pmd, the cleanup code\nwould unconditionally, and incorrectly call the pmd dtor, which\nresults in a crash (best case).\n\nThis issue was found when running the HMM selftests:\n\n  | tools/testing/selftests/mm# ./test_hmm.sh smoke\n  | ... # when unloading the test_hmm.ko module\n  | page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10915b\n  | flags: 0x1000000000000000(node=0|zone=1)\n  | raw: 1000000000000000 0000000000000000 dead000000000122 0000000000000000\n  | raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000\n  | page dumped because: VM_BUG_ON_PAGE(ptdesc-\u003epmd_huge_pte)\n  | ------------[ cut here ]------------\n  | kernel BUG at include/linux/mm.h:3080!\n  | Kernel BUG [#1]\n  | Modules linked in: test_hmm(-) sch_fq_codel fuse drm drm_panel_orientation_quirks backlight dm_mod\n  | CPU: 1 UID: 0 PID: 514 Comm: modprobe Tainted: G        W          6.12.0-00982-gf2a4f1682d07 #2\n  | Tainted: [W]=WARN\n  | Hardware name: riscv-virtio qemu/qemu, BIOS 2024.10 10/01/2024\n  | epc : remove_pgd_mapping+0xbec/0x1070\n  |  ra : remove_pgd_mapping+0xbec/0x1070\n  | epc : ffffffff80010a68 ra : ffffffff80010a68 sp : ff20000000a73940\n  |  gp : ffffffff827b2d88 tp : ff6000008785da40 t0 : ffffffff80fbce04\n  |  t1 : 0720072007200720 t2 : 706d756420656761 s0 : ff20000000a73a50\n  |  s1 : ff6000008915cff8 a0 : 0000000000000039 a1 : 0000000000000008\n  |  a2 : ff600003fff0de20 a3 : 0000000000000000 a4 : 0000000000000000\n  |  a5 : 0000000000000000 a6 : c0000000ffffefff a7 : ffffffff824469b8\n  |  s2 : ff1c0000022456c0 s3 : ff1ffffffdbfffff s4 : ff6000008915c000\n  |  s5 : ff6000008915c000 s6 : ff6000008915c000 s7 : ff1ffffffdc00000\n  |  s8 : 0000000000000001 s9 : ff1ffffffdc00000 s10: ffffffff819a31f0\n  |  s11: ffffffffffffffff t3 : ffffffff8000c950 t4 : ff60000080244f00\n  |  t5 : ff60000080244000 t6 : ff20000000a73708\n  | status: 0000000200000120 badaddr: ffffffff80010a68 cause: 0000000000000003\n  | [\u003cffffffff80010a68\u003e] remove_pgd_mapping+0xbec/0x1070\n  | [\u003cffffffff80fd238e\u003e] vmemmap_free+0x14/0x1e\n  | [\u003cffffffff8032e698\u003e] section_deactivate+0x220/0x452\n  | [\u003cffffffff8032ef7e\u003e] sparse_remove_section+0x4a/0x58\n  | [\u003cffffffff802f8700\u003e] __remove_pages+0x7e/0xba\n  | [\u003cffffffff803760d8\u003e] memunmap_pages+0x2bc/0x3fe\n  | [\u003cffffffff02a3ca28\u003e] dmirror_device_remove_chunks+0x2ea/0x518 [test_hmm]\n  | [\u003cffffffff02a3e026\u003e] hmm_dmirror_exit+0x3e/0x1018 [test_hmm]\n  | [\u003cffffffff80102c14\u003e] __riscv_sys_delete_module+0x15a/0x2a6\n  | [\u003cffffffff80fd020c\u003e] do_trap_ecall_u+0x1f2/0x266\n  | [\u003cffffffff80fde0a2\u003e] _new_vmalloc_restore_context_a0+0xc6/0xd2\n  | Code: bf51 7597 0184 8593 76a5 854a 4097 0029 80e7 2c00 (9002) 7597\n  | ---[ end trace 0000000000000000 ]---\n  | Kernel panic - not syncing: Fatal exception in interrupt\n\nAdd a check to avoid calling the pmd dtor, if the calling context is\nvmemmap_free()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T10:01:50.091Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/344945806f2f7af68be98bac02836c867f223aa9"
        },
        {
          "url": "https://git.kernel.org/stable/c/21f1b85c8912262adf51707e63614a114425eb10"
        }
      ],
      "title": "riscv: mm: Do not call pmd dtor on vmemmap page table teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56673",
    "datePublished": "2024-12-27T15:06:34.280Z",
    "dateReserved": "2024-12-27T15:00:39.845Z",
    "dateUpdated": "2025-10-01T20:07:08.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56673\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:27.210\",\"lastModified\":\"2025-10-01T20:17:39.740\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nriscv: mm: Do not call pmd dtor on vmemmap page table teardown\\n\\nThe vmemmap\u0027s, which is used for RV64 with SPARSEMEM_VMEMMAP, page\\ntables are populated using pmd (page middle directory) hugetables.\\nHowever, the pmd allocation is not using the generic mechanism used by\\nthe VMA code (e.g. pmd_alloc()), or the RISC-V specific\\ncreate_pgd_mapping()/alloc_pmd_late(). Instead, the vmemmap page table\\ncode allocates a page, and calls vmemmap_set_pmd(). This results in\\nthat the pmd ctor is *not* called, nor would it make sense to do so.\\n\\nNow, when tearing down a vmemmap page table pmd, the cleanup code\\nwould unconditionally, and incorrectly call the pmd dtor, which\\nresults in a crash (best case).\\n\\nThis issue was found when running the HMM selftests:\\n\\n  | tools/testing/selftests/mm# ./test_hmm.sh smoke\\n  | ... # when unloading the test_hmm.ko module\\n  | page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10915b\\n  | flags: 0x1000000000000000(node=0|zone=1)\\n  | raw: 1000000000000000 0000000000000000 dead000000000122 0000000000000000\\n  | raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000\\n  | page dumped because: VM_BUG_ON_PAGE(ptdesc-\u003epmd_huge_pte)\\n  | ------------[ cut here ]------------\\n  | kernel BUG at include/linux/mm.h:3080!\\n  | Kernel BUG [#1]\\n  | Modules linked in: test_hmm(-) sch_fq_codel fuse drm drm_panel_orientation_quirks backlight dm_mod\\n  | CPU: 1 UID: 0 PID: 514 Comm: modprobe Tainted: G        W          6.12.0-00982-gf2a4f1682d07 #2\\n  | Tainted: [W]=WARN\\n  | Hardware name: riscv-virtio qemu/qemu, BIOS 2024.10 10/01/2024\\n  | epc : remove_pgd_mapping+0xbec/0x1070\\n  |  ra : remove_pgd_mapping+0xbec/0x1070\\n  | epc : ffffffff80010a68 ra : ffffffff80010a68 sp : ff20000000a73940\\n  |  gp : ffffffff827b2d88 tp : ff6000008785da40 t0 : ffffffff80fbce04\\n  |  t1 : 0720072007200720 t2 : 706d756420656761 s0 : ff20000000a73a50\\n  |  s1 : ff6000008915cff8 a0 : 0000000000000039 a1 : 0000000000000008\\n  |  a2 : ff600003fff0de20 a3 : 0000000000000000 a4 : 0000000000000000\\n  |  a5 : 0000000000000000 a6 : c0000000ffffefff a7 : ffffffff824469b8\\n  |  s2 : ff1c0000022456c0 s3 : ff1ffffffdbfffff s4 : ff6000008915c000\\n  |  s5 : ff6000008915c000 s6 : ff6000008915c000 s7 : ff1ffffffdc00000\\n  |  s8 : 0000000000000001 s9 : ff1ffffffdc00000 s10: ffffffff819a31f0\\n  |  s11: ffffffffffffffff t3 : ffffffff8000c950 t4 : ff60000080244f00\\n  |  t5 : ff60000080244000 t6 : ff20000000a73708\\n  | status: 0000000200000120 badaddr: ffffffff80010a68 cause: 0000000000000003\\n  | [\u003cffffffff80010a68\u003e] remove_pgd_mapping+0xbec/0x1070\\n  | [\u003cffffffff80fd238e\u003e] vmemmap_free+0x14/0x1e\\n  | [\u003cffffffff8032e698\u003e] section_deactivate+0x220/0x452\\n  | [\u003cffffffff8032ef7e\u003e] sparse_remove_section+0x4a/0x58\\n  | [\u003cffffffff802f8700\u003e] __remove_pages+0x7e/0xba\\n  | [\u003cffffffff803760d8\u003e] memunmap_pages+0x2bc/0x3fe\\n  | [\u003cffffffff02a3ca28\u003e] dmirror_device_remove_chunks+0x2ea/0x518 [test_hmm]\\n  | [\u003cffffffff02a3e026\u003e] hmm_dmirror_exit+0x3e/0x1018 [test_hmm]\\n  | [\u003cffffffff80102c14\u003e] __riscv_sys_delete_module+0x15a/0x2a6\\n  | [\u003cffffffff80fd020c\u003e] do_trap_ecall_u+0x1f2/0x266\\n  | [\u003cffffffff80fde0a2\u003e] _new_vmalloc_restore_context_a0+0xc6/0xd2\\n  | Code: bf51 7597 0184 8593 76a5 854a 4097 0029 80e7 2c00 (9002) 7597\\n  | ---[ end trace 0000000000000000 ]---\\n  | Kernel panic - not syncing: Fatal exception in interrupt\\n\\nAdd a check to avoid calling the pmd dtor, if the calling context is\\nvmemmap_free().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: riscv: mm: No llamar a pmd dtor en el desmontaje de la tabla de p\u00e1ginas vmemmap Las tablas de p\u00e1ginas vmemmap, que se utilizan para RV64 con SPARSEMEM_VMEMMAP, se rellenan utilizando enormes tablas pmd (directorio intermedio de p\u00e1ginas). Sin embargo, la asignaci\u00f3n de pmd no utiliza el mecanismo gen\u00e9rico utilizado por el c\u00f3digo VMA (por ejemplo, pmd_alloc()), o el create_pgd_mapping()/alloc_pmd_late() espec\u00edfico de RISC-V. En su lugar, el c\u00f3digo de la tabla de p\u00e1ginas vmemmap asigna una p\u00e1gina y llama a vmemmap_set_pmd(). Esto da como resultado que el pmd ctor *no* se llame, ni tendr\u00eda sentido hacerlo. Ahora, al desmantelar un pmd de la tabla de p\u00e1ginas vmemmap, el c\u00f3digo de desinfecci\u00f3n llamar\u00eda incondicional e incorrectamente al pmd dtor, lo que da como resultado un bloqueo (en el mejor de los casos). Este problema se encontr\u00f3 al ejecutar las autopruebas de HMM: | herramientas/pruebas/autopruebas/mm# ./test_hmm.sh smoke | ... # al descargar el m\u00f3dulo test_hmm.ko | p\u00e1gina: refcount:1 mapcount:0 mapping:0000000000000000 \u00edndice:0x0 pfn:0x10915b | banderas: 0x1000000000000000(nodo=0|zona=1) | crudo: 1000000000000000 0000000000000000 dead0000000000122 0000000000000000 | raw: 0000000000000000 000000000000000 00000001ffffffff 0000000000000000 | p\u00e1gina volcada porque: VM_BUG_ON_PAGE(ptdesc-\u0026gt;pmd_huge_pte) | ------------[ cortar aqu\u00ed ]------------ | \u00a1ERROR del kernel en include/linux/mm.h:3080! | ERROR del kernel [#1] | M\u00f3dulos vinculados en: test_hmm(-) sch_fq_codel fuse drm drm_panel_orientation_quirks backlight dm_mod | CPU: 1 UID: 0 PID: 514 Comm: modprobe Contaminado: GW 6.12.0-00982-gf2a4f1682d07 #2 | Contaminado: [W]=WARN | Nombre del hardware: riscv-virtio qemu/qemu, BIOS 2024.10 10/01/2024 | epc : remove_pgd_mapping+0xbec/0x1070 | ra : remove_pgd_mapping+0xbec/0x1070 | epc : ffffffff80010a68 ra : ffffffff80010a68 sp : ff20000000a73940 | gp : ffffffff827b2d88 tp : ff6000008785da40 t0 : ffffffff80fbce04 | t1: 0720072007200720 t2: 706d756420656761 s0: ff20000000a73a50 | s1: ff6000008915cff8 a0: 0000000000000039 a1: 00000000000000008 | a2: ff600003fff0de20 a3: 0000000000000000 a4: 0000000000000000 | a5: 0000000000000000 a6: c0000000fffffff a7: ffffffff824469b8 | s2: ff1c0000022456c0 s3: ff1ffffffdbfffff s4: ff6000008915c000 | s5: ff6000008915c000 s6: ff6000008915c000 s7: ff1ffffffdc00000 | s8: 0000000000000001 s9: ff1ffffffdc00000 s10: ffffffff819a31f0 | s11: ffffffffffffffff t3: ffffffff8000c950 t4: ff60000080244f00 | t5 : ff60000080244000 t6 : ff20000000a73708 | estado: 0000000200000120 direcci\u00f3n incorrecta: ffffffff80010a68 causa: 0000000000000003 | [] eliminar_map_pgd+0xbec/0x1070 | [] vmemmap_free+0x14/0x1e | [] desactivar_secci\u00f3n+0x220/0x452 | [] eliminar_secci\u00f3n_sparse+0x4a/0x58 | [] __eliminar_p\u00e1ginas+0x7e/0xba | [] memunmap_p\u00e1ginas+0x2bc/0x3fe | [] dmirror_dispositivo_eliminar_fragmentos+0x2ea/0x518 [prueba_hmm] | [] hmm_dmirror_exit+0x3e/0x1018 [prueba_hmm] | [] __riscv_sys_eliminar_m\u00f3dulo+0x15a/0x2a6 | [] do_trap_ecall_u+0x1f2/0x266 | [] _new_vmalloc_restore_context_a0+0xc6/0xd2 | C\u00f3digo: bf51 7597 0184 8593 76a5 854a 4097 0029 80e7 2c00 (9002) 7597 | ---[ fin del seguimiento 000000000000000 ]--- | P\u00e1nico del kernel - no sincroniza: Excepci\u00f3n fatal en la interrupci\u00f3n Agregue una verificaci\u00f3n para evitar llamar al dtor pmd, si el contexto de llamada es vmemmap_free().\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.12.6\",\"matchCriteriaId\":\"97C759FD-3999-4EA7-B961-1CADF641F560\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/21f1b85c8912262adf51707e63614a114425eb10\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/344945806f2f7af68be98bac02836c867f223aa9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56673\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:59:31.187588Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:46:04.278Z\"}}], \"cna\": {\"title\": \"riscv: mm: Do not call pmd dtor on vmemmap page table teardown\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c75a74f4ba19c904c0ae1e011ae2568449409ae4\", \"lessThan\": \"344945806f2f7af68be98bac02836c867f223aa9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c75a74f4ba19c904c0ae1e011ae2568449409ae4\", \"lessThan\": \"21f1b85c8912262adf51707e63614a114425eb10\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/riscv/mm/init.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/riscv/mm/init.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/344945806f2f7af68be98bac02836c867f223aa9\"}, {\"url\": \"https://git.kernel.org/stable/c/21f1b85c8912262adf51707e63614a114425eb10\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nriscv: mm: Do not call pmd dtor on vmemmap page table teardown\\n\\nThe vmemmap\u0027s, which is used for RV64 with SPARSEMEM_VMEMMAP, page\\ntables are populated using pmd (page middle directory) hugetables.\\nHowever, the pmd allocation is not using the generic mechanism used by\\nthe VMA code (e.g. pmd_alloc()), or the RISC-V specific\\ncreate_pgd_mapping()/alloc_pmd_late(). Instead, the vmemmap page table\\ncode allocates a page, and calls vmemmap_set_pmd(). This results in\\nthat the pmd ctor is *not* called, nor would it make sense to do so.\\n\\nNow, when tearing down a vmemmap page table pmd, the cleanup code\\nwould unconditionally, and incorrectly call the pmd dtor, which\\nresults in a crash (best case).\\n\\nThis issue was found when running the HMM selftests:\\n\\n  | tools/testing/selftests/mm# ./test_hmm.sh smoke\\n  | ... # when unloading the test_hmm.ko module\\n  | page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10915b\\n  | flags: 0x1000000000000000(node=0|zone=1)\\n  | raw: 1000000000000000 0000000000000000 dead000000000122 0000000000000000\\n  | raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000\\n  | page dumped because: VM_BUG_ON_PAGE(ptdesc-\u003epmd_huge_pte)\\n  | ------------[ cut here ]------------\\n  | kernel BUG at include/linux/mm.h:3080!\\n  | Kernel BUG [#1]\\n  | Modules linked in: test_hmm(-) sch_fq_codel fuse drm drm_panel_orientation_quirks backlight dm_mod\\n  | CPU: 1 UID: 0 PID: 514 Comm: modprobe Tainted: G        W          6.12.0-00982-gf2a4f1682d07 #2\\n  | Tainted: [W]=WARN\\n  | Hardware name: riscv-virtio qemu/qemu, BIOS 2024.10 10/01/2024\\n  | epc : remove_pgd_mapping+0xbec/0x1070\\n  |  ra : remove_pgd_mapping+0xbec/0x1070\\n  | epc : ffffffff80010a68 ra : ffffffff80010a68 sp : ff20000000a73940\\n  |  gp : ffffffff827b2d88 tp : ff6000008785da40 t0 : ffffffff80fbce04\\n  |  t1 : 0720072007200720 t2 : 706d756420656761 s0 : ff20000000a73a50\\n  |  s1 : ff6000008915cff8 a0 : 0000000000000039 a1 : 0000000000000008\\n  |  a2 : ff600003fff0de20 a3 : 0000000000000000 a4 : 0000000000000000\\n  |  a5 : 0000000000000000 a6 : c0000000ffffefff a7 : ffffffff824469b8\\n  |  s2 : ff1c0000022456c0 s3 : ff1ffffffdbfffff s4 : ff6000008915c000\\n  |  s5 : ff6000008915c000 s6 : ff6000008915c000 s7 : ff1ffffffdc00000\\n  |  s8 : 0000000000000001 s9 : ff1ffffffdc00000 s10: ffffffff819a31f0\\n  |  s11: ffffffffffffffff t3 : ffffffff8000c950 t4 : ff60000080244f00\\n  |  t5 : ff60000080244000 t6 : ff20000000a73708\\n  | status: 0000000200000120 badaddr: ffffffff80010a68 cause: 0000000000000003\\n  | [\u003cffffffff80010a68\u003e] remove_pgd_mapping+0xbec/0x1070\\n  | [\u003cffffffff80fd238e\u003e] vmemmap_free+0x14/0x1e\\n  | [\u003cffffffff8032e698\u003e] section_deactivate+0x220/0x452\\n  | [\u003cffffffff8032ef7e\u003e] sparse_remove_section+0x4a/0x58\\n  | [\u003cffffffff802f8700\u003e] __remove_pages+0x7e/0xba\\n  | [\u003cffffffff803760d8\u003e] memunmap_pages+0x2bc/0x3fe\\n  | [\u003cffffffff02a3ca28\u003e] dmirror_device_remove_chunks+0x2ea/0x518 [test_hmm]\\n  | [\u003cffffffff02a3e026\u003e] hmm_dmirror_exit+0x3e/0x1018 [test_hmm]\\n  | [\u003cffffffff80102c14\u003e] __riscv_sys_delete_module+0x15a/0x2a6\\n  | [\u003cffffffff80fd020c\u003e] do_trap_ecall_u+0x1f2/0x266\\n  | [\u003cffffffff80fde0a2\u003e] _new_vmalloc_restore_context_a0+0xc6/0xd2\\n  | Code: bf51 7597 0184 8593 76a5 854a 4097 0029 80e7 2c00 (9002) 7597\\n  | ---[ end trace 0000000000000000 ]---\\n  | Kernel panic - not syncing: Fatal exception in interrupt\\n\\nAdd a check to avoid calling the pmd dtor, if the calling context is\\nvmemmap_free().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.6\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"6.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T10:01:50.091Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56673\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-01T20:07:08.957Z\", \"dateReserved\": \"2024-12-27T15:00:39.845Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T15:06:34.280Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.