{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-49886","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-10-21T12:17:06.022Z","datePublished":"2024-10-21T18:01:22.870Z","dateUpdated":"2025-11-03T22:22:52.521Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2025-05-04T09:40:28.812Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug\n\nAttaching SST PCI device to VM causes \"BUG: KASAN: slab-out-of-bounds\".\nkasan report:\n[   19.411889] ==================================================================\n[   19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[   19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113\n[   19.417368]\n[   19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G            E      6.9.0 #10\n[   19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022\n[   19.422687] Call Trace:\n[   19.424091]  <TASK>\n[   19.425448]  dump_stack_lvl+0x5d/0x80\n[   19.426963]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[   19.428694]  print_report+0x19d/0x52e\n[   19.430206]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[   19.431837]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[   19.433539]  kasan_report+0xf0/0x170\n[   19.435019]  ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[   19.436709]  _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[   19.438379]  ? __pfx_sched_clock_cpu+0x10/0x10\n[   19.439910]  isst_if_cpu_online+0x406/0x58f [isst_if_common]\n[   19.441573]  ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common]\n[   19.443263]  ? ttwu_queue_wakelist+0x2c1/0x360\n[   19.444797]  cpuhp_invoke_callback+0x221/0xec0\n[   19.446337]  cpuhp_thread_fun+0x21b/0x610\n[   19.447814]  ? __pfx_cpuhp_thread_fun+0x10/0x10\n[   19.449354]  smpboot_thread_fn+0x2e7/0x6e0\n[   19.450859]  ? __pfx_smpboot_thread_fn+0x10/0x10\n[   19.452405]  kthread+0x29c/0x350\n[   19.453817]  ? __pfx_kthread+0x10/0x10\n[   19.455253]  ret_from_fork+0x31/0x70\n[   19.456685]  ? __pfx_kthread+0x10/0x10\n[   19.458114]  ret_from_fork_asm+0x1a/0x30\n[   19.459573]  </TASK>\n[   19.460853]\n[   19.462055] Allocated by task 1198:\n[   19.463410]  kasan_save_stack+0x30/0x50\n[   19.464788]  kasan_save_track+0x14/0x30\n[   19.466139]  __kasan_kmalloc+0xaa/0xb0\n[   19.467465]  __kmalloc+0x1cd/0x470\n[   19.468748]  isst_if_cdev_register+0x1da/0x350 [isst_if_common]\n[   19.470233]  isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr]\n[   19.471670]  do_one_initcall+0xa4/0x380\n[   19.472903]  do_init_module+0x238/0x760\n[   19.474105]  load_module+0x5239/0x6f00\n[   19.475285]  init_module_from_file+0xd1/0x130\n[   19.476506]  idempotent_init_module+0x23b/0x650\n[   19.477725]  __x64_sys_finit_module+0xbe/0x130\n[   19.476506]  idempotent_init_module+0x23b/0x650\n[   19.477725]  __x64_sys_finit_module+0xbe/0x130\n[   19.478920]  do_syscall_64+0x82/0x160\n[   19.480036]  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[   19.481292]\n[   19.482205] The buggy address belongs to the object at ffff888829e65000\n which belongs to the cache kmalloc-512 of size 512\n[   19.484818] The buggy address is located 0 bytes to the right of\n allocated 512-byte region [ffff888829e65000, ffff888829e65200)\n[   19.487447]\n[   19.488328] The buggy address belongs to the physical page:\n[   19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60\n[   19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n[   19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff)\n[   19.493914] page_type: 0xffffffff()\n[   19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001\n[   19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000\n[   19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001\n[   19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000\n[   19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff\n[   19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000\n[   19.503784] page dumped because: k\n---truncated---"}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/platform/x86/intel/speed_select_if/isst_if_common.c"],"versions":[{"version":"017a634f9f38ae704d9d57817555773de700219e","lessThan":"1973c4d8ee0782a808303d75e3be9c12baaacd97","status":"affected","versionType":"git"},{"version":"9a1aac8a96dc014bec49806a7a964bf2fdbd315f","lessThan":"cdd03afcb6eda3103da5a0948d3db12372f62910","status":"affected","versionType":"git"},{"version":"9a1aac8a96dc014bec49806a7a964bf2fdbd315f","lessThan":"8176d4878ed2af5d93ddd0e971e24c412124d38b","status":"affected","versionType":"git"},{"version":"9a1aac8a96dc014bec49806a7a964bf2fdbd315f","lessThan":"cebc705b097d5c16469b141a25e840161d1c517a","status":"affected","versionType":"git"},{"version":"9a1aac8a96dc014bec49806a7a964bf2fdbd315f","lessThan":"afa7f78d9a907cfded6c98c91aae2bf7b3b56e51","status":"affected","versionType":"git"},{"version":"9a1aac8a96dc014bec49806a7a964bf2fdbd315f","lessThan":"7d59ac07ccb58f8f604f8057db63b8efcebeb3de","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/platform/x86/intel/speed_select_if/isst_if_common.c"],"versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","status":"unaffected","versionType":"semver"},{"version":"5.15.168","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.113","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.55","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.10.14","lessThanOrEqual":"6.10.*","status":"unaffected","versionType":"semver"},{"version":"6.11.3","lessThanOrEqual":"6.11.*","status":"unaffected","versionType":"semver"},{"version":"6.12","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.115","versionEndExcluding":"5.15.168"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.1.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.6.55"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.10.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.11.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.12"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1973c4d8ee0782a808303d75e3be9c12baaacd97"},{"url":"https://git.kernel.org/stable/c/cdd03afcb6eda3103da5a0948d3db12372f62910"},{"url":"https://git.kernel.org/stable/c/8176d4878ed2af5d93ddd0e971e24c412124d38b"},{"url":"https://git.kernel.org/stable/c/cebc705b097d5c16469b141a25e840161d1c517a"},{"url":"https://git.kernel.org/stable/c/afa7f78d9a907cfded6c98c91aae2bf7b3b56e51"},{"url":"https://git.kernel.org/stable/c/7d59ac07ccb58f8f604f8057db63b8efcebeb3de"}],"title":"platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-49886","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-10-22T13:44:59.932755Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-10-22T13:48:49.789Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T22:22:52.521Z"}}]}}