CVE-2024-49878 (GCVE-0-2024-49878)

Vulnerability from cvelistv5 – Published: 2024-10-21 18:01 – Updated: 2026-05-11 20:40
VLAI?
Title
resource: fix region_intersects() vs add_memory_driver_managed()
Summary
In the Linux kernel, the following vulnerability has been resolved: resource: fix region_intersects() vs add_memory_driver_managed() On a system with CXL memory, the resource tree (/proc/iomem) related to CXL memory may look like something as follows. 490000000-50fffffff : CXL Window 0 490000000-50fffffff : region0 490000000-50fffffff : dax0.0 490000000-50fffffff : System RAM (kmem) Because drivers/dax/kmem.c calls add_memory_driver_managed() during onlining CXL memory, which makes "System RAM (kmem)" a descendant of "CXL Window X". This confuses region_intersects(), which expects all "System RAM" resources to be at the top level of iomem_resource. This can lead to bugs. For example, when the following command line is executed to write some memory in CXL memory range via /dev/mem, $ dd if=data of=/dev/mem bs=$((1 << 10)) seek=$((0x490000000 >> 10)) count=1 dd: error writing '/dev/mem': Bad address 1+0 records in 0+0 records out 0 bytes copied, 0.0283507 s, 0.0 kB/s the command fails as expected. However, the error code is wrong. It should be "Operation not permitted" instead of "Bad address". More seriously, the /dev/mem permission checking in devmem_is_allowed() passes incorrectly. Although the accessing is prevented later because ioremap() isn't allowed to map system RAM, it is a potential security issue. During command executing, the following warning is reported in the kernel log for calling ioremap() on system RAM. ioremap on RAM at 0x0000000490000000 - 0x0000000490000fff WARNING: CPU: 2 PID: 416 at arch/x86/mm/ioremap.c:216 __ioremap_caller.constprop.0+0x131/0x35d Call Trace: memremap+0xcb/0x184 xlate_dev_mem_ptr+0x25/0x2f write_mem+0x94/0xfb vfs_write+0x128/0x26d ksys_write+0xac/0xfe do_syscall_64+0x9a/0xfd entry_SYSCALL_64_after_hwframe+0x4b/0x53 The details of command execution process are as follows. In the above resource tree, "System RAM" is a descendant of "CXL Window 0" instead of a top level resource. So, region_intersects() will report no System RAM resources in the CXL memory region incorrectly, because it only checks the top level resources. Consequently, devmem_is_allowed() will return 1 (allow access via /dev/mem) for CXL memory region incorrectly. Fortunately, ioremap() doesn't allow to map System RAM and reject the access. So, region_intersects() needs to be fixed to work correctly with the resource tree with "System RAM" not at top level as above. To fix it, if we found a unmatched resource in the top level, we will continue to search matched resources in its descendant resources. So, we will not miss any matched resources in resource tree anymore. In the new implementation, an example resource tree |------------- "CXL Window 0" ------------| |-- "System RAM" --| will behave similar as the following fake resource tree for region_intersects(, IORESOURCE_SYSTEM_RAM, ), |-- "System RAM" --||-- "CXL Window 0a" --| Where "CXL Window 0a" is part of the original "CXL Window 0" that isn't covered by "System RAM".
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: c221c0b0308fd01d9fb33a16f64d2fd95f8830a4 , < 333fbaf6864a4ca031367eb947961a1f3484d337 (git)
Affected: c221c0b0308fd01d9fb33a16f64d2fd95f8830a4 , < 1d5f85f1b7db79c75c9e07d6571ce2a7bdf725c4 (git)
Affected: c221c0b0308fd01d9fb33a16f64d2fd95f8830a4 , < 8a6fef7d22a1d952aed68584d3fcc0d018d2bdc3 (git)
Affected: c221c0b0308fd01d9fb33a16f64d2fd95f8830a4 , < 4b90d2eb451b357681063ba4552b10b39d7ad885 (git)
Affected: c221c0b0308fd01d9fb33a16f64d2fd95f8830a4 , < 393331e16ce205e036e58b3d8ca4ee2e635f21d9 (git)
Affected: c221c0b0308fd01d9fb33a16f64d2fd95f8830a4 , < 06ff97a20b8c9e9d256b0d2c3e87f78f8ccea3de (git)
Affected: c221c0b0308fd01d9fb33a16f64d2fd95f8830a4 , < 927abc5b7d6d2c2e936bec5a2f71d9512c5e72f7 (git)
Affected: c221c0b0308fd01d9fb33a16f64d2fd95f8830a4 , < b4afe4183ec77f230851ea139d91e5cf2644c68b (git)
Create a notification for this product.
Linux Linux Affected: 5.1
Unaffected: 0 , < 5.1 (semver)
Unaffected: 5.4.285 , ≤ 5.4.* (semver)
Unaffected: 5.10.227 , ≤ 5.10.* (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.55 , ≤ 6.6.* (semver)
Unaffected: 6.10.14 , ≤ 6.10.* (semver)
Unaffected: 6.11.3 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49878",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:46:02.318749Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:48:50.934Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:22:43.510Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "333fbaf6864a4ca031367eb947961a1f3484d337",
              "status": "affected",
              "version": "c221c0b0308fd01d9fb33a16f64d2fd95f8830a4",
              "versionType": "git"
            },
            {
              "lessThan": "1d5f85f1b7db79c75c9e07d6571ce2a7bdf725c4",
              "status": "affected",
              "version": "c221c0b0308fd01d9fb33a16f64d2fd95f8830a4",
              "versionType": "git"
            },
            {
              "lessThan": "8a6fef7d22a1d952aed68584d3fcc0d018d2bdc3",
              "status": "affected",
              "version": "c221c0b0308fd01d9fb33a16f64d2fd95f8830a4",
              "versionType": "git"
            },
            {
              "lessThan": "4b90d2eb451b357681063ba4552b10b39d7ad885",
              "status": "affected",
              "version": "c221c0b0308fd01d9fb33a16f64d2fd95f8830a4",
              "versionType": "git"
            },
            {
              "lessThan": "393331e16ce205e036e58b3d8ca4ee2e635f21d9",
              "status": "affected",
              "version": "c221c0b0308fd01d9fb33a16f64d2fd95f8830a4",
              "versionType": "git"
            },
            {
              "lessThan": "06ff97a20b8c9e9d256b0d2c3e87f78f8ccea3de",
              "status": "affected",
              "version": "c221c0b0308fd01d9fb33a16f64d2fd95f8830a4",
              "versionType": "git"
            },
            {
              "lessThan": "927abc5b7d6d2c2e936bec5a2f71d9512c5e72f7",
              "status": "affected",
              "version": "c221c0b0308fd01d9fb33a16f64d2fd95f8830a4",
              "versionType": "git"
            },
            {
              "lessThan": "b4afe4183ec77f230851ea139d91e5cf2644c68b",
              "status": "affected",
              "version": "c221c0b0308fd01d9fb33a16f64d2fd95f8830a4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.285",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.227",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.55",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nresource: fix region_intersects() vs add_memory_driver_managed()\n\nOn a system with CXL memory, the resource tree (/proc/iomem) related to\nCXL memory may look like something as follows.\n\n490000000-50fffffff : CXL Window 0\n  490000000-50fffffff : region0\n    490000000-50fffffff : dax0.0\n      490000000-50fffffff : System RAM (kmem)\n\nBecause drivers/dax/kmem.c calls add_memory_driver_managed() during\nonlining CXL memory, which makes \"System RAM (kmem)\" a descendant of \"CXL\nWindow X\".  This confuses region_intersects(), which expects all \"System\nRAM\" resources to be at the top level of iomem_resource.  This can lead to\nbugs.\n\nFor example, when the following command line is executed to write some\nmemory in CXL memory range via /dev/mem,\n\n $ dd if=data of=/dev/mem bs=$((1 \u003c\u003c 10)) seek=$((0x490000000 \u003e\u003e 10)) count=1\n dd: error writing \u0027/dev/mem\u0027: Bad address\n 1+0 records in\n 0+0 records out\n 0 bytes copied, 0.0283507 s, 0.0 kB/s\n\nthe command fails as expected.  However, the error code is wrong.  It\nshould be \"Operation not permitted\" instead of \"Bad address\".  More\nseriously, the /dev/mem permission checking in devmem_is_allowed() passes\nincorrectly.  Although the accessing is prevented later because ioremap()\nisn\u0027t allowed to map system RAM, it is a potential security issue.  During\ncommand executing, the following warning is reported in the kernel log for\ncalling ioremap() on system RAM.\n\n ioremap on RAM at 0x0000000490000000 - 0x0000000490000fff\n WARNING: CPU: 2 PID: 416 at arch/x86/mm/ioremap.c:216 __ioremap_caller.constprop.0+0x131/0x35d\n Call Trace:\n  memremap+0xcb/0x184\n  xlate_dev_mem_ptr+0x25/0x2f\n  write_mem+0x94/0xfb\n  vfs_write+0x128/0x26d\n  ksys_write+0xac/0xfe\n  do_syscall_64+0x9a/0xfd\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nThe details of command execution process are as follows.  In the above\nresource tree, \"System RAM\" is a descendant of \"CXL Window 0\" instead of a\ntop level resource.  So, region_intersects() will report no System RAM\nresources in the CXL memory region incorrectly, because it only checks the\ntop level resources.  Consequently, devmem_is_allowed() will return 1\n(allow access via /dev/mem) for CXL memory region incorrectly. \nFortunately, ioremap() doesn\u0027t allow to map System RAM and reject the\naccess.\n\nSo, region_intersects() needs to be fixed to work correctly with the\nresource tree with \"System RAM\" not at top level as above.  To fix it, if\nwe found a unmatched resource in the top level, we will continue to search\nmatched resources in its descendant resources.  So, we will not miss any\nmatched resources in resource tree anymore.\n\nIn the new implementation, an example resource tree\n\n|------------- \"CXL Window 0\" ------------|\n|-- \"System RAM\" --|\n\nwill behave similar as the following fake resource tree for\nregion_intersects(, IORESOURCE_SYSTEM_RAM, ),\n\n|-- \"System RAM\" --||-- \"CXL Window 0a\" --|\n\nWhere \"CXL Window 0a\" is part of the original \"CXL Window 0\" that\nisn\u0027t covered by \"System RAM\"."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:40:59.131Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/333fbaf6864a4ca031367eb947961a1f3484d337"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d5f85f1b7db79c75c9e07d6571ce2a7bdf725c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a6fef7d22a1d952aed68584d3fcc0d018d2bdc3"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b90d2eb451b357681063ba4552b10b39d7ad885"
        },
        {
          "url": "https://git.kernel.org/stable/c/393331e16ce205e036e58b3d8ca4ee2e635f21d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/06ff97a20b8c9e9d256b0d2c3e87f78f8ccea3de"
        },
        {
          "url": "https://git.kernel.org/stable/c/927abc5b7d6d2c2e936bec5a2f71d9512c5e72f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4afe4183ec77f230851ea139d91e5cf2644c68b"
        }
      ],
      "title": "resource: fix region_intersects() vs add_memory_driver_managed()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49878",
    "datePublished": "2024-10-21T18:01:17.468Z",
    "dateReserved": "2024-10-21T12:17:06.021Z",
    "dateUpdated": "2026-05-11T20:40:59.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49878",
      "date": "2026-05-21",
      "epss": "0.00021",
      "percentile": "0.06053"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49878\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T18:15:09.863\",\"lastModified\":\"2025-11-03T23:16:27.937\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nresource: fix region_intersects() vs add_memory_driver_managed()\\n\\nOn a system with CXL memory, the resource tree (/proc/iomem) related to\\nCXL memory may look like something as follows.\\n\\n490000000-50fffffff : CXL Window 0\\n  490000000-50fffffff : region0\\n    490000000-50fffffff : dax0.0\\n      490000000-50fffffff : System RAM (kmem)\\n\\nBecause drivers/dax/kmem.c calls add_memory_driver_managed() during\\nonlining CXL memory, which makes \\\"System RAM (kmem)\\\" a descendant of \\\"CXL\\nWindow X\\\".  This confuses region_intersects(), which expects all \\\"System\\nRAM\\\" resources to be at the top level of iomem_resource.  This can lead to\\nbugs.\\n\\nFor example, when the following command line is executed to write some\\nmemory in CXL memory range via /dev/mem,\\n\\n $ dd if=data of=/dev/mem bs=$((1 \u003c\u003c 10)) seek=$((0x490000000 \u003e\u003e 10)) count=1\\n dd: error writing \u0027/dev/mem\u0027: Bad address\\n 1+0 records in\\n 0+0 records out\\n 0 bytes copied, 0.0283507 s, 0.0 kB/s\\n\\nthe command fails as expected.  However, the error code is wrong.  It\\nshould be \\\"Operation not permitted\\\" instead of \\\"Bad address\\\".  More\\nseriously, the /dev/mem permission checking in devmem_is_allowed() passes\\nincorrectly.  Although the accessing is prevented later because ioremap()\\nisn\u0027t allowed to map system RAM, it is a potential security issue.  During\\ncommand executing, the following warning is reported in the kernel log for\\ncalling ioremap() on system RAM.\\n\\n ioremap on RAM at 0x0000000490000000 - 0x0000000490000fff\\n WARNING: CPU: 2 PID: 416 at arch/x86/mm/ioremap.c:216 __ioremap_caller.constprop.0+0x131/0x35d\\n Call Trace:\\n  memremap+0xcb/0x184\\n  xlate_dev_mem_ptr+0x25/0x2f\\n  write_mem+0x94/0xfb\\n  vfs_write+0x128/0x26d\\n  ksys_write+0xac/0xfe\\n  do_syscall_64+0x9a/0xfd\\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n\\nThe details of command execution process are as follows.  In the above\\nresource tree, \\\"System RAM\\\" is a descendant of \\\"CXL Window 0\\\" instead of a\\ntop level resource.  So, region_intersects() will report no System RAM\\nresources in the CXL memory region incorrectly, because it only checks the\\ntop level resources.  Consequently, devmem_is_allowed() will return 1\\n(allow access via /dev/mem) for CXL memory region incorrectly. \\nFortunately, ioremap() doesn\u0027t allow to map System RAM and reject the\\naccess.\\n\\nSo, region_intersects() needs to be fixed to work correctly with the\\nresource tree with \\\"System RAM\\\" not at top level as above.  To fix it, if\\nwe found a unmatched resource in the top level, we will continue to search\\nmatched resources in its descendant resources.  So, we will not miss any\\nmatched resources in resource tree anymore.\\n\\nIn the new implementation, an example resource tree\\n\\n|------------- \\\"CXL Window 0\\\" ------------|\\n|-- \\\"System RAM\\\" --|\\n\\nwill behave similar as the following fake resource tree for\\nregion_intersects(, IORESOURCE_SYSTEM_RAM, ),\\n\\n|-- \\\"System RAM\\\" --||-- \\\"CXL Window 0a\\\" --|\\n\\nWhere \\\"CXL Window 0a\\\" is part of the original \\\"CXL Window 0\\\" that\\nisn\u0027t covered by \\\"System RAM\\\".\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: recurso: corregir region_intersects() frente a add_memory_driver_managed() En un sistema con memoria CXL, el \u00e1rbol de recursos (/proc/iomem) relacionado con la memoria CXL puede parecerse a lo siguiente. 490000000-50fffffff: CXL Window 0 490000000-50fffffff: region0 490000000-50fffffff: dax0.0 490000000-50fffffff: RAM del sistema (kmem) Debido a que drivers/dax/kmem.c llama a add_memory_driver_managed() durante la conexi\u00f3n en l\u00ednea de la memoria CXL, lo que hace que \\\"System RAM (kmem)\\\" sea un descendiente de \\\"CXL Window X\\\". Esto confunde a region_intersects(), que espera que todos los recursos de \\\"RAM del sistema\\\" est\u00e9n en el nivel superior de iomem_resource. Esto puede provocar errores. Por ejemplo, cuando se ejecuta la siguiente l\u00ednea de comando para escribir algo de memoria en el rango de memoria CXL a trav\u00e9s de /dev/mem, $ dd if=data of=/dev/mem bs=$((1 \u0026lt;\u0026lt; 10)) seek=$((0x490000000 \u0026gt;\u0026gt; 10)) count=1 dd: error writing \u0027/dev/mem\u0027: Bad address 1+0 records in 0+0 records out 0 bytes copies, 0.0283507 s, 0.0 kB/s el comando falla como se esperaba. Sin embargo, el c\u00f3digo de error es incorrecto. Deber\u00eda ser \\\"Operaci\u00f3n no permitida\\\" en lugar de \\\"Direcci\u00f3n incorrecta\\\". M\u00e1s grave a\u00fan, la comprobaci\u00f3n de permisos de /dev/mem en devmem_is_allowed() pasa incorrectamente. Aunque el acceso se impide m\u00e1s tarde porque ioremap() no tiene permiso para mapear la RAM del sistema, es un problema de seguridad potencial. Durante la ejecuci\u00f3n del comando, se informa la siguiente advertencia en el registro del n\u00facleo por llamar a ioremap() en la RAM del sistema. ioremap en RAM en 0x0000000490000000 - 0x0000000490000fff ADVERTENCIA: CPU: 2 PID: 416 en arch/x86/mm/ioremap.c:216 __ioremap_caller.constprop.0+0x131/0x35d Rastreo de llamadas: memremap+0xcb/0x184 xlate_dev_mem_ptr+0x25/0x2f write_mem+0x94/0xfb vfs_write+0x128/0x26d ksys_write+0xac/0xfe do_syscall_64+0x9a/0xfd entry_SYSCALL_64_after_hwframe+0x4b/0x53 Los detalles del proceso de ejecuci\u00f3n del comando son los siguientes. En el \u00e1rbol de recursos anterior, \\\"System RAM\\\" es un descendiente de \\\"CXL Window 0\\\" en lugar de un recurso de nivel superior. Por lo tanto, region_intersects() no informar\u00e1 de forma incorrecta ning\u00fan recurso de System RAM en la regi\u00f3n de memoria CXL, porque solo comprueba los recursos de nivel superior. En consecuencia, devmem_is_allowed() devolver\u00e1 1 (permitir\u00e1 el acceso a trav\u00e9s de /dev/mem) para la regi\u00f3n de memoria CXL de forma incorrecta. Afortunadamente, ioremap() no permite mapear System RAM y rechazar el acceso. Por lo tanto, es necesario corregir region_intersects() para que funcione correctamente con el \u00e1rbol de recursos con \\\"System RAM\\\" no en el nivel superior como se indica anteriormente. Para corregirlo, si encontramos un recurso no coincidente en el nivel superior, continuaremos buscando recursos coincidentes en sus recursos descendientes. Por lo tanto, ya no nos perderemos ning\u00fan recurso coincidente en el \u00e1rbol de recursos. En la nueva implementaci\u00f3n, un \u00e1rbol de recursos de ejemplo |------------- \\\"CXL Window 0\\\" ------------| |-- \\\"System RAM\\\" --| se comportar\u00e1 de manera similar al siguiente \u00e1rbol de recursos falso para region_intersects(, IORESOURCE_SYSTEM_RAM, ), |-- \\\"RAM del sistema\\\" --||-- \\\"Ventana CXL 0a\\\" --| Donde \\\"Ventana CXL 0a\\\" es parte de la \\\"Ventana CXL 0\\\" original que no est\u00e1 cubierta por la \\\"RAM del sistema\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.1\",\"versionEndExcluding\":\"5.10.227\",\"matchCriteriaId\":\"AD732A27-BE8B-4786-B27A-0C7AEF3D4588\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"4D51C05D-455B-4D8D-89E7-A58E140B864C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.55\",\"matchCriteriaId\":\"E90B9576-56C4-47BC-AAB0-C5B2D438F5D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.14\",\"matchCriteriaId\":\"4C16BCE0-FFA0-4599-BE0A-1FD65101C021\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/06ff97a20b8c9e9d256b0d2c3e87f78f8ccea3de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1d5f85f1b7db79c75c9e07d6571ce2a7bdf725c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/333fbaf6864a4ca031367eb947961a1f3484d337\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/393331e16ce205e036e58b3d8ca4ee2e635f21d9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4b90d2eb451b357681063ba4552b10b39d7ad885\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8a6fef7d22a1d952aed68584d3fcc0d018d2bdc3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/927abc5b7d6d2c2e936bec5a2f71d9512c5e72f7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b4afe4183ec77f230851ea139d91e5cf2644c68b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:22:43.510Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49878\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:46:02.318749Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:46:05.391Z\"}}], \"cna\": {\"title\": \"resource: fix region_intersects() vs add_memory_driver_managed()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c221c0b0308fd01d9fb33a16f64d2fd95f8830a4\", \"lessThan\": \"333fbaf6864a4ca031367eb947961a1f3484d337\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c221c0b0308fd01d9fb33a16f64d2fd95f8830a4\", \"lessThan\": \"1d5f85f1b7db79c75c9e07d6571ce2a7bdf725c4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c221c0b0308fd01d9fb33a16f64d2fd95f8830a4\", \"lessThan\": \"8a6fef7d22a1d952aed68584d3fcc0d018d2bdc3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c221c0b0308fd01d9fb33a16f64d2fd95f8830a4\", \"lessThan\": \"4b90d2eb451b357681063ba4552b10b39d7ad885\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c221c0b0308fd01d9fb33a16f64d2fd95f8830a4\", \"lessThan\": \"393331e16ce205e036e58b3d8ca4ee2e635f21d9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c221c0b0308fd01d9fb33a16f64d2fd95f8830a4\", \"lessThan\": \"06ff97a20b8c9e9d256b0d2c3e87f78f8ccea3de\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c221c0b0308fd01d9fb33a16f64d2fd95f8830a4\", \"lessThan\": \"927abc5b7d6d2c2e936bec5a2f71d9512c5e72f7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c221c0b0308fd01d9fb33a16f64d2fd95f8830a4\", \"lessThan\": \"b4afe4183ec77f230851ea139d91e5cf2644c68b\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/resource.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.1\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.1\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.55\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/resource.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/333fbaf6864a4ca031367eb947961a1f3484d337\"}, {\"url\": \"https://git.kernel.org/stable/c/1d5f85f1b7db79c75c9e07d6571ce2a7bdf725c4\"}, {\"url\": \"https://git.kernel.org/stable/c/8a6fef7d22a1d952aed68584d3fcc0d018d2bdc3\"}, {\"url\": \"https://git.kernel.org/stable/c/4b90d2eb451b357681063ba4552b10b39d7ad885\"}, {\"url\": \"https://git.kernel.org/stable/c/393331e16ce205e036e58b3d8ca4ee2e635f21d9\"}, {\"url\": \"https://git.kernel.org/stable/c/06ff97a20b8c9e9d256b0d2c3e87f78f8ccea3de\"}, {\"url\": \"https://git.kernel.org/stable/c/927abc5b7d6d2c2e936bec5a2f71d9512c5e72f7\"}, {\"url\": \"https://git.kernel.org/stable/c/b4afe4183ec77f230851ea139d91e5cf2644c68b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nresource: fix region_intersects() vs add_memory_driver_managed()\\n\\nOn a system with CXL memory, the resource tree (/proc/iomem) related to\\nCXL memory may look like something as follows.\\n\\n490000000-50fffffff : CXL Window 0\\n  490000000-50fffffff : region0\\n    490000000-50fffffff : dax0.0\\n      490000000-50fffffff : System RAM (kmem)\\n\\nBecause drivers/dax/kmem.c calls add_memory_driver_managed() during\\nonlining CXL memory, which makes \\\"System RAM (kmem)\\\" a descendant of \\\"CXL\\nWindow X\\\".  This confuses region_intersects(), which expects all \\\"System\\nRAM\\\" resources to be at the top level of iomem_resource.  This can lead to\\nbugs.\\n\\nFor example, when the following command line is executed to write some\\nmemory in CXL memory range via /dev/mem,\\n\\n $ dd if=data of=/dev/mem bs=$((1 \u003c\u003c 10)) seek=$((0x490000000 \u003e\u003e 10)) count=1\\n dd: error writing \u0027/dev/mem\u0027: Bad address\\n 1+0 records in\\n 0+0 records out\\n 0 bytes copied, 0.0283507 s, 0.0 kB/s\\n\\nthe command fails as expected.  However, the error code is wrong.  It\\nshould be \\\"Operation not permitted\\\" instead of \\\"Bad address\\\".  More\\nseriously, the /dev/mem permission checking in devmem_is_allowed() passes\\nincorrectly.  Although the accessing is prevented later because ioremap()\\nisn\u0027t allowed to map system RAM, it is a potential security issue.  During\\ncommand executing, the following warning is reported in the kernel log for\\ncalling ioremap() on system RAM.\\n\\n ioremap on RAM at 0x0000000490000000 - 0x0000000490000fff\\n WARNING: CPU: 2 PID: 416 at arch/x86/mm/ioremap.c:216 __ioremap_caller.constprop.0+0x131/0x35d\\n Call Trace:\\n  memremap+0xcb/0x184\\n  xlate_dev_mem_ptr+0x25/0x2f\\n  write_mem+0x94/0xfb\\n  vfs_write+0x128/0x26d\\n  ksys_write+0xac/0xfe\\n  do_syscall_64+0x9a/0xfd\\n  entry_SYSCALL_64_after_hwframe+0x4b/0x53\\n\\nThe details of command execution process are as follows.  In the above\\nresource tree, \\\"System RAM\\\" is a descendant of \\\"CXL Window 0\\\" instead of a\\ntop level resource.  So, region_intersects() will report no System RAM\\nresources in the CXL memory region incorrectly, because it only checks the\\ntop level resources.  Consequently, devmem_is_allowed() will return 1\\n(allow access via /dev/mem) for CXL memory region incorrectly. \\nFortunately, ioremap() doesn\u0027t allow to map System RAM and reject the\\naccess.\\n\\nSo, region_intersects() needs to be fixed to work correctly with the\\nresource tree with \\\"System RAM\\\" not at top level as above.  To fix it, if\\nwe found a unmatched resource in the top level, we will continue to search\\nmatched resources in its descendant resources.  So, we will not miss any\\nmatched resources in resource tree anymore.\\n\\nIn the new implementation, an example resource tree\\n\\n|------------- \\\"CXL Window 0\\\" ------------|\\n|-- \\\"System RAM\\\" --|\\n\\nwill behave similar as the following fake resource tree for\\nregion_intersects(, IORESOURCE_SYSTEM_RAM, ),\\n\\n|-- \\\"System RAM\\\" --||-- \\\"CXL Window 0a\\\" --|\\n\\nWhere \\\"CXL Window 0a\\\" is part of the original \\\"CXL Window 0\\\" that\\nisn\u0027t covered by \\\"System RAM\\\".\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.285\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.227\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.55\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.14\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.3\", \"versionStartIncluding\": \"5.1\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"5.1\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:40:11.535Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49878\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T22:22:43.510Z\", \"dateReserved\": \"2024-10-21T12:17:06.021Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:01:17.468Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.