CVE-2024-44965
"Linux x86 PMD Alignment Assumption Vulnerability"
Description
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix pti_clone_pgtable() alignment assumption Guenter reported dodgy crashes on an i386-nosmp build using GCC-11 that had the form of endless traps until entry stack exhaust and then #DF from the stack guard. It turned out that pti_clone_pgtable() had alignment assumptions on the start address, notably it hard assumes start is PMD aligned. This is true on x86_64, but very much not true on i386. These assumptions can cause the end condition to malfunction, leading to a 'short' clone. Guess what happens when the user mapping has a short copy of the entry text? Use the correct increment form for addr to avoid alignment assumptions.
INFO
Published Date :
Sept. 4, 2024, 7:15 p.m.
Last Modified :
Oct. 4, 2024, 4:17 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-44965.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-44965 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-44965 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Oct. 04, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Changed Reference Type https://git.kernel.org/stable/c/18da1b27ce16a14a9b636af9232acb4fb24f4c9e No Types Assigned https://git.kernel.org/stable/c/18da1b27ce16a14a9b636af9232acb4fb24f4c9e Patch Changed Reference Type https://git.kernel.org/stable/c/25a727233a40a9b33370eec9f0cad67d8fd312f8 No Types Assigned https://git.kernel.org/stable/c/25a727233a40a9b33370eec9f0cad67d8fd312f8 Patch Changed Reference Type https://git.kernel.org/stable/c/41e71dbb0e0a0fe214545fe64af031303a08524c No Types Assigned https://git.kernel.org/stable/c/41e71dbb0e0a0fe214545fe64af031303a08524c Patch Changed Reference Type https://git.kernel.org/stable/c/4d143ae782009b43b4f366402e5c37f59d4e4346 No Types Assigned https://git.kernel.org/stable/c/4d143ae782009b43b4f366402e5c37f59d4e4346 Patch Changed Reference Type https://git.kernel.org/stable/c/5c580c1050bcbc15c3e78090859d798dcf8c9763 No Types Assigned https://git.kernel.org/stable/c/5c580c1050bcbc15c3e78090859d798dcf8c9763 Patch Changed Reference Type https://git.kernel.org/stable/c/ca07aab70dd3b5e7fddb62d7a6ecd7a7d6d0b2ed No Types Assigned https://git.kernel.org/stable/c/ca07aab70dd3b5e7fddb62d7a6ecd7a7d6d0b2ed Patch Changed Reference Type https://git.kernel.org/stable/c/d00c9b4bbc442d99e1dafbdfdab848bc1ead73f6 No Types Assigned https://git.kernel.org/stable/c/d00c9b4bbc442d99e1dafbdfdab848bc1ead73f6 Patch Changed Reference Type https://git.kernel.org/stable/c/df3eecb5496f87263d171b254ca6e2758ab3c35c No Types Assigned https://git.kernel.org/stable/c/df3eecb5496f87263d171b254ca6e2758ab3c35c Patch Added CWE NIST NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.19 up to (excluding) 4.19.320 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.282 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.224 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.165 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.105 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.46 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.10.5 *cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:* -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 04, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix pti_clone_pgtable() alignment assumption Guenter reported dodgy crashes on an i386-nosmp build using GCC-11 that had the form of endless traps until entry stack exhaust and then #DF from the stack guard. It turned out that pti_clone_pgtable() had alignment assumptions on the start address, notably it hard assumes start is PMD aligned. This is true on x86_64, but very much not true on i386. These assumptions can cause the end condition to malfunction, leading to a 'short' clone. Guess what happens when the user mapping has a short copy of the entry text? Use the correct increment form for addr to avoid alignment assumptions. Added Reference kernel.org https://git.kernel.org/stable/c/18da1b27ce16a14a9b636af9232acb4fb24f4c9e [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/25a727233a40a9b33370eec9f0cad67d8fd312f8 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/d00c9b4bbc442d99e1dafbdfdab848bc1ead73f6 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/4d143ae782009b43b4f366402e5c37f59d4e4346 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/5c580c1050bcbc15c3e78090859d798dcf8c9763 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/ca07aab70dd3b5e7fddb62d7a6ecd7a7d6d0b2ed [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/df3eecb5496f87263d171b254ca6e2758ab3c35c [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/41e71dbb0e0a0fe214545fe64af031303a08524c [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-44965 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-44965
weaknesses.