CVE-2024-53107

fs/proc/task_mmu: prevent integer overflow in pagemap_scan_get_args()

Severity Score

"-"

*CVSS v-

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

fs/proc/task_mmu: prevent integer overflow in pagemap_scan_get_args()

The "arg->vec_len" variable is a u64 that comes from the user at the start
of the function. The "arg->vec_len * sizeof(struct page_region))"
multiplication can lead to integer wrapping. Use size_mul() to avoid
that.

Also the size_add/mul() functions work on unsigned long so for 32bit
systems we need to ensure that "arg->vec_len" fits in an unsigned long.

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/proc/task_mmu: evitar el desbordamiento de enteros en pagemap_scan_get_args() La variable "arg->vec_len" es una u64 que proviene del usuario al inicio de la función. La multiplicación "arg->vec_len * sizeof(struct page_region))" puede provocar un ajuste de enteros. Utilice size_mul() para evitarlo. Además, las funciones size_add/mul() funcionan en unsigned long, por lo que para los sistemas de 32 bits debemos asegurarnos de que "arg->vec_len" quepa en un unsigned long.

*Credits: N/A

CVSS Scores

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2024-11-19 CVE Reserved
2024-12-02 CVE Published
2024-12-02 CVE Updated
---------- EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (3)

URL	Tag	Source
https://git.kernel.org/stable/c/52526ca7fdb905a768a93f8faa418e9b988fc34b	Vuln. Introduced

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/adee03f8903c58a6a559f21388a430211fac8ce9	2024-11-22
https://git.kernel.org/stable/c/669b0cb81e4e4e78cff77a5b367c7f70c0c6c05e	2024-11-15

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 6.7 < 6.11.10 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.7 < 6.11.10"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 6.7 < 6.12 Search vendor "Linux" for product "Linux Kernel" and version " >= 6.7 < 6.12"		en		Affected