CVE-2021-46910

{"id": "CVE-2021-46910", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-02-27T07:15:07.307", "references": [{"url": "https://git.kernel.org/stable/c/5965ac11b1d5fcb38464728931649cd9df79c7c9", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d624833f5984d484c5e3196f34b926f9e71dafee", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabled\n\nThe debugging code for kmap_local() doubles the number of per-CPU fixmap\nslots allocated for kmap_local(), in order to use half of them as guard\nregions. This causes the fixmap region to grow downwards beyond the start\nof its reserved window if the supported number of CPUs is large, and collide\nwith the newly added virtual DT mapping right below it, which is obviously\nnot good.\n\nOne manifestation of this is EFI boot on a kernel built with NR_CPUS=32\nand CONFIG_DEBUG_KMAP_LOCAL=y, which may pass the FDT in highmem, resulting\nin block entries below the fixmap region that the fixmap code misidentifies\nas fixmap table entries, and subsequently tries to dereference using a\nphys-to-virt translation that is only valid for lowmem. This results in a\ncryptic splat such as the one below.\n\n ftrace: allocating 45548 entries in 89 pages\n 8<--- cut here ---\n Unable to handle kernel paging request at virtual address fc6006f0\n pgd = (ptrval)\n [fc6006f0] *pgd=80000040207003, *pmd=00000000\n Internal error: Oops: a06 [#1] SMP ARM\n Modules linked in:\n CPU: 0 PID: 0 Comm: swapper Not tainted 5.11.0+ #382\n Hardware name: Generic DT based system\n PC is at cpu_ca15_set_pte_ext+0x24/0x30\n LR is at __set_fixmap+0xe4/0x118\n pc : [<c041ac9c>] lr : [<c04189d8>] psr: 400000d3\n sp : c1601ed8 ip : 00400000 fp : 00800000\n r10: 0000071f r9 : 00421000 r8 : 00c00000\n r7 : 00c00000 r6 : 0000071f r5 : ffade000 r4 : 4040171f\n r3 : 00c00000 r2 : 4040171f r1 : c041ac78 r0 : fc6006f0\n Flags: nZcv IRQs off FIQs off Mode SVC_32 ISA ARM Segment none\n Control: 30c5387d Table: 40203000 DAC: 00000001\n Process swapper (pid: 0, stack limit = 0x(ptrval))\n\nSo let's limit CONFIG_NR_CPUS to 16 when CONFIG_DEBUG_KMAP_LOCAL=y. Also,\nfix the BUILD_BUG_ON() check that was supposed to catch this, by checking\nwhether the region grows below the start address rather than above the end\naddress."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ARM: 9063/1: mm: reduce el n\u00famero m\u00e1ximo de CPU si DEBUG_KMAP_LOCAL est\u00e1 habilitado El c\u00f3digo de depuraci\u00f3n para kmap_local() duplica el n\u00famero de ranuras de mapas de reparaci\u00f3n por CPU asignadas para kmap_local() , para utilizar la mitad de ellos como regiones de guardia. Esto hace que la regi\u00f3n del mapa de arreglos crezca hacia abajo m\u00e1s all\u00e1 del inicio de su ventana reservada si la cantidad de CPU admitidas es grande, y colisiona con el mapeo de DT virtual reci\u00e9n agregado justo debajo, lo cual obviamente no es bueno. Una manifestaci\u00f3n de esto es el arranque EFI en un kernel creado con NR_CPUS=32 y CONFIG_DEBUG_KMAP_LOCAL=y, que puede pasar la FDT en highmem, lo que genera entradas de bloque debajo de la regi\u00f3n de fixmap que el c\u00f3digo de fixmap identifica err\u00f3neamente como entradas de la tabla de fixmap y, posteriormente, intenta desreferencia usando una traducci\u00f3n de phys a virt que solo es v\u00e1lida para lowmem. Esto da como resultado un s\u00edmbolo cr\u00edptico como el que se muestra a continuaci\u00f3n. ftrace: asignando 45548 entradas en 89 p\u00e1ginas 8&lt;--- cortar aqu\u00ed --- No se puede manejar la solicitud de paginaci\u00f3n del kernel en la direcci\u00f3n virtual fc6006f0 pgd = (ptrval) [fc6006f0] *pgd=80000040207003, *pmd=00000000 Error interno: Ups: a06 [#1] M\u00f3dulos SMP ARM vinculados en: CPU: 0 PID: 0 Comm: swapper Not tainted 5.11.0+ #382 Nombre del hardware: Sistema gen\u00e9rico basado en DT La PC est\u00e1 en cpu_ca15_set_pte_ext+0x24/0x30 LR est\u00e1 en __set_fixmap+0xe4/ 0x118 pc: [] lr: [] psr: 400000d3 sp: c1601ed8 ip: 00400000 fp: 00800000 r10: 0000071f r9: 00421000 r8: 00c00000 r7: 00c00000 r6: 0000071f r5: ffade000 r4: 4040171f r3: 00c00000 r2: 4040171f r1: c041ac78 r0: fc6006f0 Banderas: nZcv IRQ desactivadas FIQ desactivadas Modo SVC_32 ISA ARM Segmento ninguno Control: 30c5387d Tabla: 40203000 DAC: 00000001 Intercambiador de procesos (pid: 0, l\u00edmite de pila = 0x(ptr) val)) As\u00ed que limitemos CONFIG_NR_CPUS a 16 cuando CONFIG_DEBUG_KMAP_LOCAL=y. Adem\u00e1s, corrija la verificaci\u00f3n BUILD_BUG_ON() que se supon\u00eda detectar\u00eda esto, verificando si la regi\u00f3n crece por debajo de la direcci\u00f3n inicial en lugar de por encima de la direcci\u00f3n final."}], "lastModified": "2024-04-17T16:55:44.690", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C5242B9-B5BD-4578-AD66-69DF59D54A14", "versionEndExcluding": "5.11.16", "versionStartIncluding": "5.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}