PT-2025-3670 · Linux+6 · Linux Kernel+6
Published
2025-01-08
·
Updated
2026-05-26
·
CVE-2024-57945
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.74
Description
The issue is related to the calculation of the virtual address of vmemmap in the sparse vmemmap model. The virtual address is calculated as ((struct page *)VMEMMAP START - (phys ram base >> PAGE SHIFT)), and the struct page's va can be calculated with an offset: (vmemmap + (pfn)). However, when initializing struct pages, the kernel starts from the first page from the same section that phys ram base belongs to. If the first page's physical address is not (phys ram base >> PAGE SHIFT), then we get an va below VMEMMAP START when calculating va for it's struct page. This can lead to an out of bound issue. The fix introduces a new variable 'vmemmap start pfn' which is aligned with memory section size and uses it to calculate vmemmap address instead of phys ram base.
Recommendations
To resolve the issue, update to Linux kernel version 6.6.74 or later. As a temporary workaround, consider restricting access to the vulnerable
vmemmap module to minimize the risk of exploitation. Avoid using the phys ram base variable in calculations until the issue is resolved.Exploit
Fix
DoS
Improper Initialization
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Ubuntu