CVE-2024-56678

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-56678
In the Linux kernel, the following vulnerability has been resolved: powerpc/mm/fault: Fix kfence page fault reporting copy_from_kernel_nofault() can be called when doing read of /proc/kcore. /proc/kcore can have some unmapped kfence objects which when read via copy_from_kernel_nofault() can cause page faults. Since *_nofault() functions define their own fixup table for handling fault, use that instead of asking kfence to handle such faults. Hence we search the exception tables for the nip which generated the fault. If there is an entry then we let the fixup table handler handle the page fault by returning an error from within ___do_page_fault(). This can be easily triggered if someone tries to do dd from /proc/kcore. eg. dd if=/proc/kcore of=/dev/null bs=1M Some example false negatives: =============================== BUG: KFENCE: invalid read in copy_from_kernel_nofault+0x9c/0x1a0 Invalid read at 0xc0000000fdff0000: copy_from_kernel_nofault+0x9c/0x1a0 0xc00000000665f950 read_kcore_iter+0x57c/0xa04 proc_reg_read_iter+0xe4/0x16c vfs_read+0x320/0x3ec ksys_read+0x90/0x154 system_call_exception+0x120/0x310 system_call_vectored_common+0x15c/0x2ec BUG: KFENCE: use-after-free read in copy_from_kernel_nofault+0x9c/0x1a0 Use-after-free read at 0xc0000000fe050000 (in kfence-#2): copy_from_kernel_nofault+0x9c/0x1a0 0xc00000000665f950 read_kcore_iter+0x57c/0xa04 proc_reg_read_iter+0xe4/0x16c vfs_read+0x320/0x3ec ksys_read+0x90/0x154 system_call_exception+0x120/0x310 system_call_vectored_common+0x15c/0x2ec

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/06dbbb4d5f7126b6307ab807cbf04ecfc459b933 Patch
https://git.kernel.org/stable/c/15f78d2c3d1452645bd8b9da909b0ca266f83c43 Patch
https://git.kernel.org/stable/c/4d2655754e94741b159aa807b72ea85518a65fd5 Patch
https://git.kernel.org/stable/c/7eaeb7a49b6d16640f9f3c9074c05175d74c710b Patch
https://git.kernel.org/stable/c/9ea8d8bf9b625e8ad3be6b0432aecdc549914121 Patch
https://git.kernel.org/stable/c/e0a470b5733c1fe068d5c58b0bb91ad539604bc6 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

24 Mar 2025, 17:32

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/06dbbb4d5f7126b6307ab807cbf04ecfc459b933 - () https://git.kernel.org/stable/c/06dbbb4d5f7126b6307ab807cbf04ecfc459b933 - Patch
References () https://git.kernel.org/stable/c/15f78d2c3d1452645bd8b9da909b0ca266f83c43 - () https://git.kernel.org/stable/c/15f78d2c3d1452645bd8b9da909b0ca266f83c43 - Patch
References () https://git.kernel.org/stable/c/4d2655754e94741b159aa807b72ea85518a65fd5 - () https://git.kernel.org/stable/c/4d2655754e94741b159aa807b72ea85518a65fd5 - Patch
References () https://git.kernel.org/stable/c/7eaeb7a49b6d16640f9f3c9074c05175d74c710b - () https://git.kernel.org/stable/c/7eaeb7a49b6d16640f9f3c9074c05175d74c710b - Patch
References () https://git.kernel.org/stable/c/9ea8d8bf9b625e8ad3be6b0432aecdc549914121 - () https://git.kernel.org/stable/c/9ea8d8bf9b625e8ad3be6b0432aecdc549914121 - Patch
References () https://git.kernel.org/stable/c/e0a470b5733c1fe068d5c58b0bb91ad539604bc6 - () https://git.kernel.org/stable/c/e0a470b5733c1fe068d5c58b0bb91ad539604bc6 - Patch
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

11 Feb 2025, 16:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: powerpc/mm/fault: Arreglar el informe de fallos de página de kfence. Se puede llamar a copy_from_kernel_nofault() al realizar una lectura de /proc/kcore. /proc/kcore puede tener algunos objetos kfence no mapeados que, cuando se leen mediante copy_from_kernel_nofault(), pueden causar fallos de página. Dado que las funciones *_nofault() definen su propia tabla de correcciones para gestionar los fallos, utilícela en lugar de pedirle a kfence que se encargue de dichos fallos. Por lo tanto, buscamos en las tablas de excepciones el nip que generó el fallo. Si hay una entrada, dejamos que el controlador de la tabla de correcciones se encargue del fallo de página devolviendo un error desde dentro de ___do_page_fault(). Esto se puede activar fácilmente si alguien intenta hacer dd desde /proc/kcore. p. ej. dd if=/proc/kcore of=/dev/null bs=1M Algunos ejemplos de falsos negativos: ================================ ERROR: KFENCE: lectura no válida en copy_from_kernel_nofault+0x9c/0x1a0 Lectura no válida en 0xc0000000fdff0000: copy_from_kernel_nofault+0x9c/0x1a0 0xc00000000665f950 read_kcore_iter+0x57c/0xa04 proc_reg_read_iter+0xe4/0x16c vfs_read+0x320/0x3ec ksys_read+0x90/0x154 system_call_exception+0x120/0x310 ERROR: KFENCE: lectura de use-after-free en copy_from_kernel_nofault+0x9c/0x1a0 Lectura de use-after-free en 0xc0000000fe050000 (en kfence-#2): copy_from_kernel_nofault+0x9c/0x1a0 0xc00000000665f950 read_kcore_iter+0x57c/0xa04 proc_reg_read_iter+0xe4/0x16c vfs_read+0x320/0x3ec ksys_read+0x90/0x154 system_call_exception+0x120/0x310 system_call_vectored_common+0x15c/0x2ec
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-416

28 Dec 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-28 10:15

Updated : 2025-03-24 17:32

NVD link : CVE-2024-56678

Mitre link : CVE-2024-56678

CVE.ORG link : CVE-2024-56678

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free