GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-42293 (GCVE-0-2024-42293)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:09 – Updated: 2026-08-05 11:36
VLAI
Title
arm64: mm: Fix lockless walks with static and dynamic page-table folding
Summary
In the Linux kernel, the following vulnerability has been resolved: arm64: mm: Fix lockless walks with static and dynamic page-table folding Lina reports random oopsen originating from the fast GUP code when 16K pages are used with 4-level page-tables, the fourth level being folded at runtime due to lack of LPA2. In this configuration, the generic implementation of p4d_offset_lockless() will return a 'p4d_t *' corresponding to the 'pgd_t' allocated on the stack of the caller, gup_fast_pgd_range(). This is normally fine, but when the fourth level of page-table is folded at runtime, pud_offset_lockless() will offset from the address of the 'p4d_t' to calculate the address of the PUD in the same page-table page. This results in a stray stack read when the 'p4d_t' has been allocated on the stack and can send the walker into the weeds. Fix the problem by providing our own definition of p4d_offset_lockless() when CONFIG_PGTABLE_LEVELS <= 4 which returns the real page-table pointer rather than the address of the local stack variable.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:10 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0dd4f60a2c76938c2625f6c630c225699d97608b , < 78672d49d3eebbcda3589f4d6e589caf357c5a59 (git)
Affected: 0dd4f60a2c76938c2625f6c630c225699d97608b , < 36639013b3462c06ff8e3400a427f775b4fc97f5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.10.3 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42293",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:10:57.009784Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:29.368Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/pgtable.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "78672d49d3eebbcda3589f4d6e589caf357c5a59",
              "status": "affected",
              "version": "0dd4f60a2c76938c2625f6c630c225699d97608b",
              "versionType": "git"
            },
            {
              "lessThan": "36639013b3462c06ff8e3400a427f775b4fc97f5",
              "status": "affected",
              "version": "0dd4f60a2c76938c2625f6c630c225699d97608b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/include/asm/pgtable.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: mm: Fix lockless walks with static and dynamic page-table folding\n\nLina reports random oopsen originating from the fast GUP code when\n16K pages are used with 4-level page-tables, the fourth level being\nfolded at runtime due to lack of LPA2.\n\nIn this configuration, the generic implementation of\np4d_offset_lockless() will return a \u0027p4d_t *\u0027 corresponding to the\n\u0027pgd_t\u0027 allocated on the stack of the caller, gup_fast_pgd_range().\nThis is normally fine, but when the fourth level of page-table is folded\nat runtime, pud_offset_lockless() will offset from the address of the\n\u0027p4d_t\u0027 to calculate the address of the PUD in the same page-table page.\nThis results in a stray stack read when the \u0027p4d_t\u0027 has been allocated\non the stack and can send the walker into the weeds.\n\nFix the problem by providing our own definition of p4d_offset_lockless()\nwhen CONFIG_PGTABLE_LEVELS \u003c= 4 which returns the real page-table\npointer rather than the address of the local stack variable."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached via ordinary syscalls that invoke GUP-fast on `current-\u003emm` (O_DIRECT read/write, io_uring, vmsplice, futex, process_vm_readv), and it walks the calling task\u0027s own kernel stack. This requires local code execution; there is no remote or adjacent trigger.\nAC:L - No race and no unpredictable state is needed \u2014 the stray stack read happens on every GUP-fast call in the affected configuration, and the attacker directly selects which 8-byte stack word is used as a PUD by choosing the user address (`pud_index(addr) = (addr \u003e\u003e 36) \u0026 2047` covers the whole 16K stack). The vulnerable build (16K pages with the default 52-bit VA) plus non-LPA2 hardware is a real, widely shipped deployment (Asahi Linux, 16KB-page Android), and is not a condition the attacker must win.\nPR:L - Any unprivileged local user can call `pread()`/`pwrite()` on an O_DIRECT fd, `vmsplice()`, `futex()`, or io_uring to enter `gup_fast_fallback()`. No capability, namespace, or other access check exists on the path.\nUI:N - The attacker triggers the fault entirely through their own syscalls on their own address space; no victim action or cooperation is needed.\nS:U - The corruption and its consequences are confined to the kernel\u0027s own security authority \u2014 standard kernel memory corruption and privilege escalation, not a VM or IOMMU boundary crossing.\nC:H - Attacker-controlled kernel-stack words (including `pt_regs`-held user register values) are interpreted as PUD/PMD/PTE entries with no `pfn_valid()` check in production builds, so `pud_page()`/`pte_page()` returns a struct page for an arbitrary PFN that the caller then reads \u2014 an arbitrary physical memory read primitive (e.g. dumping kernel memory via an O_DIRECT write).\nI:H - The same fabricated page-table walk lets an O_DIRECT read or io_uring write target arbitrary physical pages, and `try_grab_folio()` performs a refcount increment on a struct page synthesized from a fully controlled 64-bit value, giving arbitrary write primitives suitable for control-flow hijacking and privilege escalation.\nA:H - The reporter observed random kernel oopsen from the fast GUP code in this configuration, and dereferencing garbage as page-table entries reliably produces kernel panics and refcount corruption."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:25.572Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/78672d49d3eebbcda3589f4d6e589caf357c5a59"
        },
        {
          "url": "https://git.kernel.org/stable/c/36639013b3462c06ff8e3400a427f775b4fc97f5"
        }
      ],
      "title": "arm64: mm: Fix lockless walks with static and dynamic page-table folding",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42293",
    "datePublished": "2024-08-17T09:09:02.303Z",
    "dateReserved": "2024-07-30T07:40:12.268Z",
    "dateUpdated": "2026-08-05T11:36:25.572Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-42293",
      "date": "2026-09-15",
      "epss": "0.00203",
      "percentile": "0.1044"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\narm64: mm: Fix lockless walks with static and dynamic page-table folding\\n\\nLina reports random oopsen originating from the fast GUP code when\\n16K pages are used with 4-level page-tables, the fourth level being\\nfolded at runtime due to lack of LPA2.\\n\\nIn this configuration, the generic implementation of\\np4d_offset_lockless() will return a \u0027p4d_t *\u0027 corresponding to the\\n\u0027pgd_t\u0027 allocated on the stack of the caller, gup_fast_pgd_range().\\nThis is normally fine, but when the fourth level of page-table is folded\\nat runtime, pud_offset_lockless() will offset from the address of the\\n\u0027p4d_t\u0027 to calculate the address of the PUD in the same page-table page.\\nThis results in a stray stack read when the \u0027p4d_t\u0027 has been allocated\\non the stack and can send the walker into the weeds.\\n\\nFix the problem by providing our own definition of p4d_offset_lockless()\\nwhen CONFIG_PGTABLE_LEVELS \u003c= 4 which returns the real page-table\\npointer rather than the address of the local stack variable.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: arm64: mm: corrige recorridos sin bloqueo con plegado de tablas de p\\u00e1ginas est\\u00e1ticas y din\\u00e1micas. Lina informa oopsen aleatorios que se originan en el c\\u00f3digo GUP r\\u00e1pido cuando se utilizan p\\u00e1ginas de 16 KB con tablas de p\\u00e1ginas de 4 niveles. el cuarto nivel se pliega en tiempo de ejecuci\\u00f3n debido a la falta de LPA2. En esta configuraci\\u00f3n, la implementaci\\u00f3n gen\\u00e9rica de p4d_offset_lockless() devolver\\u00e1 un \u0027p4d_t *\u0027 correspondiente al \u0027pgd_t\u0027 asignado en la pila de la persona que llama, gup_fast_pgd_range(). Esto normalmente est\\u00e1 bien, pero cuando el cuarto nivel de la tabla de p\\u00e1ginas se pliega en tiempo de ejecuci\\u00f3n, pud_offset_lockless() se desplazar\\u00e1 de la direcci\\u00f3n de \u0027p4d_t\u0027 para calcular la direcci\\u00f3n del PUD en la misma p\\u00e1gina de la tabla de p\\u00e1ginas. Esto da como resultado una lectura de pila perdida cuando el \u0027p4d_t\u0027 se ha asignado en la pila y puede enviar al caminante hacia la maleza. Solucione el problema proporcionando nuestra propia definici\\u00f3n de p4d_offset_lockless() cuando CONFIG_PGTABLE_LEVELS \u0026lt;= 4, que devuelve el puntero de la tabla de p\\u00e1ginas real en lugar de la direcci\\u00f3n de la variable de pila local.\"}]",
      "id": "CVE-2024-42293",
      "lastModified": "2024-08-19T12:59:59.177",
      "published": "2024-08-17T09:15:09.867",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/36639013b3462c06ff8e3400a427f775b4fc97f5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/78672d49d3eebbcda3589f4d6e589caf357c5a59\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42293\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-17T09:15:09.867\",\"lastModified\":\"2026-08-04T11:19:47.803\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\narm64: mm: Fix lockless walks with static and dynamic page-table folding\\n\\nLina reports random oopsen originating from the fast GUP code when\\n16K pages are used with 4-level page-tables, the fourth level being\\nfolded at runtime due to lack of LPA2.\\n\\nIn this configuration, the generic implementation of\\np4d_offset_lockless() will return a \u0027p4d_t *\u0027 corresponding to the\\n\u0027pgd_t\u0027 allocated on the stack of the caller, gup_fast_pgd_range().\\nThis is normally fine, but when the fourth level of page-table is folded\\nat runtime, pud_offset_lockless() will offset from the address of the\\n\u0027p4d_t\u0027 to calculate the address of the PUD in the same page-table page.\\nThis results in a stray stack read when the \u0027p4d_t\u0027 has been allocated\\non the stack and can send the walker into the weeds.\\n\\nFix the problem by providing our own definition of p4d_offset_lockless()\\nwhen CONFIG_PGTABLE_LEVELS \u003c= 4 which returns the real page-table\\npointer rather than the address of the local stack variable.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: arm64: mm: corrige recorridos sin bloqueo con plegado de tablas de p\u00e1ginas est\u00e1ticas y din\u00e1micas. Lina informa oopsen aleatorios que se originan en el c\u00f3digo GUP r\u00e1pido cuando se utilizan p\u00e1ginas de 16 KB con tablas de p\u00e1ginas de 4 niveles. el cuarto nivel se pliega en tiempo de ejecuci\u00f3n debido a la falta de LPA2. En esta configuraci\u00f3n, la implementaci\u00f3n gen\u00e9rica de p4d_offset_lockless() devolver\u00e1 un \u0027p4d_t *\u0027 correspondiente al \u0027pgd_t\u0027 asignado en la pila de la persona que llama, gup_fast_pgd_range(). Esto normalmente est\u00e1 bien, pero cuando el cuarto nivel de la tabla de p\u00e1ginas se pliega en tiempo de ejecuci\u00f3n, pud_offset_lockless() se desplazar\u00e1 de la direcci\u00f3n de \u0027p4d_t\u0027 para calcular la direcci\u00f3n del PUD en la misma p\u00e1gina de la tabla de p\u00e1ginas. Esto da como resultado una lectura de pila perdida cuando el \u0027p4d_t\u0027 se ha asignado en la pila y puede enviar al caminante hacia la maleza. Solucione el problema proporcionando nuestra propia definici\u00f3n de p4d_offset_lockless() cuando CONFIG_PGTABLE_LEVELS \u0026lt;= 4, que devuelve el puntero de la tabla de p\u00e1ginas real en lugar de la direcci\u00f3n de la variable de pila local.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm64/include/asm/pgtable.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0dd4f60a2c76938c2625f6c630c225699d97608b\",\"lessThan\":\"78672d49d3eebbcda3589f4d6e589caf357c5a59\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0dd4f60a2c76938c2625f6c630c225699d97608b\",\"lessThan\":\"36639013b3462c06ff8e3400a427f775b4fc97f5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm64/include/asm/pgtable.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.3\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:10:57.009784Z\",\"id\":\"CVE-2024-42293\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.10.3\",\"matchCriteriaId\":\"3332351F-A9A1-4AD4-BEDB-5B3BBD5B7279\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/36639013b3462c06ff8e3400a427f775b4fc97f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78672d49d3eebbcda3589f4d6e589caf357c5a59\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:37:19+00:00",
      "cve": "CVE-2024-42293",
      "id": "CVE-2024-42293",
      "initial_release_date": "2024-08-17T00:00:00+00:00",
      "product_status:known_affected": "28",
      "product_status:known_not_affected": "170",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: arm64: mm: Fix lockless walks with static and dynamic page-table folding",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-42293.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:50:46Z",
      "cve": "CVE-2024-42293",
      "id": "CVE-2024-42293",
      "initial_release_date": "2024-08-18T02:02:31Z",
      "product_status:known_not_affected": "371",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-42293",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-42293.json",
      "version": "21"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42293\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:10:57.009784Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:23.664Z\"}}], \"cna\": {\"title\": \"arm64: mm: Fix lockless walks with static and dynamic page-table folding\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0dd4f60a2c76938c2625f6c630c225699d97608b\", \"lessThan\": \"78672d49d3eebbcda3589f4d6e589caf357c5a59\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0dd4f60a2c76938c2625f6c630c225699d97608b\", \"lessThan\": \"36639013b3462c06ff8e3400a427f775b4fc97f5\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/arm64/include/asm/pgtable.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/arm64/include/asm/pgtable.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/78672d49d3eebbcda3589f4d6e589caf357c5a59\"}, {\"url\": \"https://git.kernel.org/stable/c/36639013b3462c06ff8e3400a427f775b4fc97f5\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\narm64: mm: Fix lockless walks with static and dynamic page-table folding\\n\\nLina reports random oopsen originating from the fast GUP code when\\n16K pages are used with 4-level page-tables, the fourth level being\\nfolded at runtime due to lack of LPA2.\\n\\nIn this configuration, the generic implementation of\\np4d_offset_lockless() will return a \u0027p4d_t *\u0027 corresponding to the\\n\u0027pgd_t\u0027 allocated on the stack of the caller, gup_fast_pgd_range().\\nThis is normally fine, but when the fourth level of page-table is folded\\nat runtime, pud_offset_lockless() will offset from the address of the\\n\u0027p4d_t\u0027 to calculate the address of the PUD in the same page-table page.\\nThis results in a stray stack read when the \u0027p4d_t\u0027 has been allocated\\non the stack and can send the walker into the weeds.\\n\\nFix the problem by providing our own definition of p4d_offset_lockless()\\nwhen CONFIG_PGTABLE_LEVELS \u003c= 4 which returns the real page-table\\npointer rather than the address of the local stack variable.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.3\", \"versionStartIncluding\": \"6.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"6.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:26:08.429Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42293\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:26:08.429Z\", \"dateReserved\": \"2024-07-30T07:40:12.268Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-17T09:09:02.303Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.