{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-42293","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-07-30T07:40:12.268Z","datePublished":"2024-08-17T09:09:02.303Z","dateUpdated":"2026-08-05T11:36:25.572Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:36:25.572Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: mm: Fix lockless walks with static and dynamic page-table folding\n\nLina reports random oopsen originating from the fast GUP code when\n16K pages are used with 4-level page-tables, the fourth level being\nfolded at runtime due to lack of LPA2.\n\nIn this configuration, the generic implementation of\np4d_offset_lockless() will return a 'p4d_t *' corresponding to the\n'pgd_t' allocated on the stack of the caller, gup_fast_pgd_range().\nThis is normally fine, but when the fourth level of page-table is folded\nat runtime, pud_offset_lockless() will offset from the address of the\n'p4d_t' to calculate the address of the PUD in the same page-table page.\nThis results in a stray stack read when the 'p4d_t' has been allocated\non the stack and can send the walker into the weeds.\n\nFix the problem by providing our own definition of p4d_offset_lockless()\nwhen CONFIG_PGTABLE_LEVELS <= 4 which returns the real page-table\npointer rather than the address of the local stack variable."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached via ordinary syscalls that invoke GUP-fast on `current->mm` (O_DIRECT read/write, io_uring, vmsplice, futex, process_vm_readv), and it walks the calling task's own kernel stack. This requires local code execution; there is no remote or adjacent trigger.\nAC:L - No race and no unpredictable state is needed — the stray stack read happens on every GUP-fast call in the affected configuration, and the attacker directly selects which 8-byte stack word is used as a PUD by choosing the user address (`pud_index(addr) = (addr >> 36) & 2047` covers the whole 16K stack). The vulnerable build (16K pages with the default 52-bit VA) plus non-LPA2 hardware is a real, widely shipped deployment (Asahi Linux, 16KB-page Android), and is not a condition the attacker must win.\nPR:L - Any unprivileged local user can call `pread()`/`pwrite()` on an O_DIRECT fd, `vmsplice()`, `futex()`, or io_uring to enter `gup_fast_fallback()`. No capability, namespace, or other access check exists on the path.\nUI:N - The attacker triggers the fault entirely through their own syscalls on their own address space; no victim action or cooperation is needed.\nS:U - The corruption and its consequences are confined to the kernel's own security authority — standard kernel memory corruption and privilege escalation, not a VM or IOMMU boundary crossing.\nC:H - Attacker-controlled kernel-stack words (including `pt_regs`-held user register values) are interpreted as PUD/PMD/PTE entries with no `pfn_valid()` check in production builds, so `pud_page()`/`pte_page()` returns a struct page for an arbitrary PFN that the caller then reads — an arbitrary physical memory read primitive (e.g. dumping kernel memory via an O_DIRECT write).\nI:H - The same fabricated page-table walk lets an O_DIRECT read or io_uring write target arbitrary physical pages, and `try_grab_folio()` performs a refcount increment on a struct page synthesized from a fully controlled 64-bit value, giving arbitrary write primitives suitable for control-flow hijacking and privilege escalation.\nA:H - The reporter observed random kernel oopsen from the fast GUP code in this configuration, and dereferencing garbage as page-table entries reliably produces kernel panics and refcount corruption."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/include/asm/pgtable.h"],"versions":[{"version":"0dd4f60a2c76938c2625f6c630c225699d97608b","lessThan":"78672d49d3eebbcda3589f4d6e589caf357c5a59","status":"affected","versionType":"git"},{"version":"0dd4f60a2c76938c2625f6c630c225699d97608b","lessThan":"36639013b3462c06ff8e3400a427f775b4fc97f5","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/arm64/include/asm/pgtable.h"],"versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","status":"unaffected","versionType":"semver"},{"version":"6.10.3","lessThanOrEqual":"6.10.*","status":"unaffected","versionType":"semver"},{"version":"6.11","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.10.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.11"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/78672d49d3eebbcda3589f4d6e589caf357c5a59"},{"url":"https://git.kernel.org/stable/c/36639013b3462c06ff8e3400a427f775b4fc97f5"}],"title":"arm64: mm: Fix lockless walks with static and dynamic page-table folding","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-42293","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T16:10:57.009784Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-12T17:33:29.368Z"}}]}}