CVE-2024-26675: ppp_async: limit MRU to 64K
In the Linux kernel, the following vulnerability has been resolved:
pppasync: limit MRU to 64K
syzbot triggered a warning [1] in allocpages():
WARNONONCEGFP(order > MAXPAGEORDER, gfp)
Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K")
Adopt the same sanity check for pppasyncioctl(PPPIOCSMRU)
[1]:
WARNING: CPU: 1 PID: 11 at mm/pagealloc.c:4543 allocpages+0x308/0x698 mm/pagealloc.c:4543 Modules linked in: CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: eventsunbound flushtoldisc pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : allocpages+0x308/0x698 mm/pagealloc.c:4543 lr : allocpages+0xc8/0x698 mm/pagealloc.c:4537 sp : ffff800093967580 x29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000 x26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0 x23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8 x20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120 x17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005 x14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000 x11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001 x8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f x5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020 x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0 Call trace: allocpages+0x308/0x698 mm/pagealloc.c:4543 allocpagesnode include/linux/gfp.h:238 [inline] allocpagesnode include/linux/gfp.h:261 [inline] kmalloclargenode+0xbc/0x1fc mm/slub.c:3926 dokmallocnode mm/slub.c:3969 [inline] kmallocnodetrackcaller+0x418/0x620 mm/slub.c:4001 kmallocreserve+0x17c/0x23c net/core/skbuff.c:590 allocskb+0x1c8/0x3d8 net/core/skbuff.c:651 netdevallocskb+0xb8/0x3e8 net/core/skbuff.c:715 netdevallocskb include/linux/skbuff.h:3235 [inline] devallocskb include/linux/skbuff.h:3248 [inline] pppasyncinput drivers/net/ppp/pppasync.c:863 [inline] pppasyncttyreceive+0x588/0x186c drivers/net/ppp/pppasync.c:341 ttyldiscreceivebuf+0x12c/0x15c drivers/tty/ttybuffer.c:390 ttyportdefaultreceivebuf+0x74/0xac drivers/tty/ttyport.c:37 receivebuf drivers/tty/ttybuffer.c:444 [inline] flushtoldisc+0x284/0x6e4 drivers/tty/ttybuffer.c:494 processonework+0x694/0x1204 kernel/workqueue.c:2633 processscheduledworks kernel/workqueue.c:2706 [inline] workerthread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 retfromfork+0x10/0x20 arch/arm64/kernel/entry.S:860
Other sources
In the Linux kernel, the following vulnerability has been resolved:
pppasync: limit MRU to 64K
The Linux kernel CVE team has assigned CVE-2024-26675 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040252-CVE-2024-26675-5b19@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26675?
CVE-2024-26675 is classified as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-26675?
To fix CVE-2024-26675, update the Linux kernel to one of the patched versions specified by your distribution such as 4.19.307 or later.
What systems are affected by CVE-2024-26675?
CVE-2024-26675 affects various versions of the Linux kernel across Red Hat and Debian distributions.
What kind of vulnerability is CVE-2024-26675?
CVE-2024-26675 is related to ppp_async and involves a potential memory management issue in the Linux kernel.
Are there any known exploits for CVE-2024-26675?
As of now, there are no public exploits specifically for CVE-2024-26675 reported in the wild.