CVE-2024-26795

unknown

Published — · Modified —

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

—

Description

In the Linux kernel, the following vulnerability has been resolved: riscv: Sparse-Memory/vmemmap out-of-bounds fix Offset vmemmap so that the first page of vmemmap will be mapped to the first page of physical memory in order to ensure that vmemmap’s bounds will be respected during pfn_to_page()/page_to_pfn() operations. The conversion macros will produce correct SV39/48/57 addresses for every possible/valid DRAM_BASE inside the physical memory limits. v2:Address Alex's comments

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2024-26795 NameCVE-2024-26795 DescriptionIn the Linux kernel, the following vulnerability has been resolved: riscv: Sparse-Memory/vmemmap out-of-bounds fix Offset vmemmap so that the first page of vmemmap will be mapped to the first page of physical memory in order to ensure that vmemmap’s bounds will be respected during pfn_to_page()/page_to_pfn() operations. The conversion macros will…

CVE-2024-26795

Name	CVE-2024-26795
Description	In the Linux kernel, the following vulnerability has been resolved: riscv: Sparse-Memory/vmemmap out-of-bounds fix Offset vmemmap so that the first page of vmemmap will be mapped to the first page of physical memory in order to ensure that vmemmap’s bounds will be respected during pfn_to_page()/page_to_pfn() operations. The conversion macros will produce correct SV39/48/57 addresses for every possible/valid DRAM_BASE inside the physical memory limits. v2:Address Alex's comments
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3842-1, DSA-5681-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
linux (PTS)	bullseye	5.10.223-1	fixed
	bullseye (security)	5.10.257-1	fixed
	bookworm	6.1.170-3	fixed
	bookworm (security)	6.1.172-1	fixed
	trixie	6.12.86-1	fixed
	trixie (security)	6.12.90-1	fixed
	forky	7.0.9-1	fixed
	sid	7.0.10-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
linux	source	buster	(not affected)
linux	source	bullseye	5.10.216-1	DSA-5681-1
linux	source	bookworm	6.1.82-1
linux	source	(unstable)	6.7.9-1
linux-5.10	source	buster	5.10.216-1~deb10u1	DLA-3842-1

Notes

[buster] - linux <not-affected> (Vulnerable code not present)
https://git.kernel.org/linus/a11dd49dcb9376776193e15641f84fcc1e5980c9 (6.8-rc7)

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

[buster] - linux <not-affected> (Vulnerable code not present)https://git.kernel.org/linus/a11dd49dcb9376776193e15641f84fcc1e5980c9 (6.8-rc7)

OS impact

OS	Version	Status	Fixed in
sles		affected
debian	bookworm	fixed	`6.1.82-1`
debian	bullseye	fixed	`5.10.216-1`
debian	forky	fixed	`6.7.9-1`
debian	sid	fixed	`6.7.9-1`
debian	trixie	fixed	`6.7.9-1`

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.