{"dataType":"CVE_RECORD","cveMetadata":{"cveId":"CVE-2024-26712","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-19T14:20:24.159Z","datePublished":"2024-04-03T14:55:14.149Z","dateUpdated":"2026-08-05T11:26:49.646Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:26:49.646Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/kasan: Fix addr error caused by page alignment\n\nIn kasan_init_region, when k_start is not page aligned, at the begin of\nfor loop, k_cur = k_start & PAGE_MASK is less than k_start, and then\n`va = block + k_cur - k_start` is less than block, the addr va is invalid,\nbecause the memory address space from va to block is not alloced by\nmemblock_alloc, which will not be reserved by memblock_reserve later, it\nwill be used by other places.\n\nAs a result, memory overwriting occurs.\n\nfor example:\nint __init __weak kasan_init_region(void *start, size_t size)\n{\n[...]\n\t/* if say block(dcd97000) k_start(feef7400) k_end(feeff3fe) */\n\tblock = memblock_alloc(k_end - k_start, PAGE_SIZE);\n\t[...]\n\tfor (k_cur = k_start & PAGE_MASK; k_cur < k_end; k_cur += PAGE_SIZE) {\n\t\t/* at the begin of for loop\n\t\t * block(dcd97000) va(dcd96c00) k_cur(feef7000) k_start(feef7400)\n\t\t * va(dcd96c00) is less than block(dcd97000), va is invalid\n\t\t */\n\t\tvoid *va = block + k_cur - k_start;\n\t\t[...]\n\t}\n[...]\n}\n\nTherefore, page alignment is performed on k_start before\nmemblock_alloc() to ensure the validity of the VA address."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is `__init`/boot-time PPC32 KASAN shadow setup with no network-facing entry point; the resulting aliased page is exercised only by local kernel activity (allocations, module loads) on the affected machine.\nAC:L - On a system that boots into the misaligned state, the corrupting writes are continuous and trivially driven — any ordinary allocation/free path writes KASAN shadow bytes into the co-owned page, requiring no special timing, race, or memory layout the attacker must win.\nPR:L - No elevated privilege is needed to drive the corruption; an unprivileged local process performing ordinary syscalls generates the kmalloc/kfree shadow poisoning that writes into the unreserved page, and running a KASAN kernel is a configuration precondition rather than a privilege the attacker exercises.\nUI:N - The bad shadow mapping is established autonomously during boot and the corruption proceeds without any victim action.\nS:U - Kernel memory corrupting other kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unreserved page is aliased into the KASAN shadow window while simultaneously being allocated to arbitrary consumers (page cache, slab, user pages), so contents of other security contexts are exposed through the shadow mapping and the uncontrolled corruption is leverageable for disclosure.\nI:H - This is out-of-bounds kernel writes into a page owned by unrelated code — the commit explicitly states \"memory overwriting occurs\" — corrupting live slab objects, page tables, or page cache, which is memory corruption exploitable for control-flow influence.\nA:H - Silent overwriting of randomly allocated pages, including potential page tables and slab metadata, reliably produces oopses and kernel panics."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/powerpc/mm/kasan/init_32.c"],"versions":[{"version":"663c0c9496a69f80011205ba3194049bcafd681d","lessThan":"230e89b5ad0a33f530a2a976b3e5e4385cb27882","status":"affected","versionType":"git"},{"version":"663c0c9496a69f80011205ba3194049bcafd681d","lessThan":"2738e0aa2fb24a7ab9c878d912dc2b239738c6c6","status":"affected","versionType":"git"},{"version":"663c0c9496a69f80011205ba3194049bcafd681d","lessThan":"0c09912dd8387e228afcc5e34ac5d79b1e3a1058","status":"affected","versionType":"git"},{"version":"663c0c9496a69f80011205ba3194049bcafd681d","lessThan":"0516c06b19dc64807c10e01bb99b552bdf2d7dbe","status":"affected","versionType":"git"},{"version":"663c0c9496a69f80011205ba3194049bcafd681d","lessThan":"70ef2ba1f4286b2b73675aeb424b590c92d57b25","status":"affected","versionType":"git"},{"version":"663c0c9496a69f80011205ba3194049bcafd681d","lessThan":"4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0","status":"affected","versionType":"git"},{"version":"5ce93076d8ee2a0fac3ad4adbd2e91b6197146db","status":"affected","versionType":"git"},{"version":"5.3.6","lessThan":"5.4","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/powerpc/mm/kasan/init_32.c"],"versions":[{"version":"5.4","status":"affected"},{"version":"0","lessThan":"5.4","status":"unaffected","versionType":"semver"},{"version":"5.10.210","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.149","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.79","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.18","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.6","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"5.10.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"5.15.149"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.1.79"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.6.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.7.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.3.6"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/230e89b5ad0a33f530a2a976b3e5e4385cb27882"},{"url":"https://git.kernel.org/stable/c/2738e0aa2fb24a7ab9c878d912dc2b239738c6c6"},{"url":"https://git.kernel.org/stable/c/0c09912dd8387e228afcc5e34ac5d79b1e3a1058"},{"url":"https://git.kernel.org/stable/c/0516c06b19dc64807c10e01bb99b552bdf2d7dbe"},{"url":"https://git.kernel.org/stable/c/70ef2ba1f4286b2b73675aeb424b590c92d57b25"},{"url":"https://git.kernel.org/stable/c/4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0"}],"title":"powerpc/kasan: Fix addr error caused by page alignment","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"problemTypes":[{"descriptions":[{"type":"CWE","lang":"en","description":"CWE-noinfo Not enough information"}]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.4,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"HIGH","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-04-04T15:22:01.316380Z","id":"CVE-2024-26712","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-05-07T20:00:37.857Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T00:14:12.618Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/230e89b5ad0a33f530a2a976b3e5e4385cb27882","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/2738e0aa2fb24a7ab9c878d912dc2b239738c6c6","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/0c09912dd8387e228afcc5e34ac5d79b1e3a1058","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/0516c06b19dc64807c10e01bb99b552bdf2d7dbe","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/70ef2ba1f4286b2b73675aeb424b590c92d57b25","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/4a7aee96200ad281a5cc4cf5c7a2e2a49d2b97b0","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","tags":["x_transferred"]}]}]},"dataVersion":"5.2"}