Executive Summary

Informations
Name CVE-2024-39474 First vendor Publication 2024-07-05
Vendor Cve Last vendor Modification 2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Overall CVSS Score 5.5
Base Score 5.5 Environmental Score 5.5
impact SubScore 3.6 Temporal Score 5.5
Exploitabality Sub Score 1.8
 
Attack Vector Local Attack Complexity Low
Privileges Required Low User Interaction None
Scope Unchanged Confidentiality Impact None
Integrity Impact None Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score N/A Attack Range N/A
Cvss Impact Score N/A Attack Complexity N/A
Cvss Expoit Score N/A Authentication N/A
Calculate full CVSS 2.0 Vectors scores

Detail

In the Linux kernel, the following vulnerability has been resolved:

mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL

commit a421ef303008 ("mm: allow !GFP_KERNEL allocations for kvmalloc") includes support for __GFP_NOFAIL, but it presents a conflict with commit dd544141b9eb ("vmalloc: back off when the current task is OOM-killed"). A possible scenario is as follows:

process-a __vmalloc_node_range(GFP_KERNEL | __GFP_NOFAIL)
__vmalloc_area_node()
vm_area_alloc_pages()
--> oom-killer send SIGKILL to process-a
if (fatal_signal_pending(current)) break; --> return NULL;

To fix this, do not check fatal_signal_pending() in vm_area_alloc_pages() if __GFP_NOFAIL set.

This issue occurred during OPLUS KASAN TEST. Below is part of the log -> oom-killer sends signal to process [65731.222840] [ T1308] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/apps/uid_10198,task=gs.intelligence,pid=32454,uid=10198

[65731.259685] [T32454] Call trace: [65731.259698] [T32454] dump_backtrace+0xf4/0x118 [65731.259734] [T32454] show_stack+0x18/0x24 [65731.259756] [T32454] dump_stack_lvl+0x60/0x7c [65731.259781] [T32454] dump_stack+0x18/0x38 [65731.259800] [T32454] mrdump_common_die+0x250/0x39c [mrdump] [65731.259936] [T32454] ipanic_die+0x20/0x34 [mrdump] [65731.260019] [T32454] atomic_notifier_call_chain+0xb4/0xfc [65731.260047] [T32454] notify_die+0x114/0x198 [65731.260073] [T32454] die+0xf4/0x5b4 [65731.260098] [T32454] die_kernel_fault+0x80/0x98 [65731.260124] [T32454] __do_kernel_fault+0x160/0x2a8 [65731.260146] [T32454] do_bad_area+0x68/0x148 [65731.260174] [T32454] do_mem_abort+0x151c/0x1b34 [65731.260204] [T32454] el1_abort+0x3c/0x5c [65731.260227] [T32454] el1h_64_sync_handler+0x54/0x90 [65731.260248] [T32454] el1h_64_sync+0x68/0x6c

[65731.260269] [T32454] z_erofs_decompress_queue+0x7f0/0x2258 --> be->decompressed_pages = kvcalloc(be->nr_pages, sizeof(struct page *), GFP_KERNEL | __GFP_NOFAIL);
kernel panic by NULL pointer dereference.
erofs assume kvmalloc with __GFP_NOFAIL never return NULL. [65731.260293] [T32454] z_erofs_runqueue+0xf30/0x104c [65731.260314] [T32454] z_erofs_readahead+0x4f0/0x968 [65731.260339] [T32454] read_pages+0x170/0xadc [65731.260364] [T32454] page_cache_ra_unbounded+0x874/0xf30 [65731.260388] [T32454] page_cache_ra_order+0x24c/0x714 [65731.260411] [T32454] filemap_fault+0xbf0/0x1a74 [65731.260437] [T32454] __do_fault+0xd0/0x33c [65731.260462] [T32454] handle_mm_fault+0xf74/0x3fe0 [65731.260486] [T32454] do_mem_abort+0x54c/0x1b34 [65731.260509] [T32454] el0_da+0x44/0x94 [65731.260531] [T32454] el0t_64_sync_handler+0x98/0xb4 [65731.260553] [T32454] el0t_64_sync+0x198/0x19c

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39474

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-770 Allocation of Resources Without Limits or Throttling

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 8
Os 3668

Sources (Detail)

https://git.kernel.org/stable/c/198a80833e3421d4c9820a4ae907120adf598c91
https://git.kernel.org/stable/c/758678b65164b2158fc1de411092191cb3c394d4
https://git.kernel.org/stable/c/8e0545c83d672750632f46e3f9ad95c48c91a0fc
https://git.kernel.org/stable/c/c55d3564ad25ce87ab7cc6af251f9574faebd8da
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
Date Informations
2025-06-26 02:32:30
  • Multiple Updates
2025-06-25 12:31:49
  • Multiple Updates
2025-06-24 02:37:09
  • Multiple Updates
2025-05-27 02:41:36
  • Multiple Updates
2025-03-29 03:37:53
  • Multiple Updates
2025-03-28 13:43:13
  • Multiple Updates
2025-03-28 03:16:30
  • Multiple Updates
2025-03-19 03:11:55
  • Multiple Updates
2025-03-18 03:24:48
  • Multiple Updates
2025-03-14 03:12:09
  • Multiple Updates
2025-03-06 14:08:33
  • Multiple Updates
2025-02-22 03:22:03
  • Multiple Updates
2025-01-08 03:03:24
  • Multiple Updates
2025-01-07 03:02:58
  • Multiple Updates
2024-12-25 03:01:36
  • Multiple Updates
2024-12-12 03:04:33
  • Multiple Updates
2024-11-25 09:24:16
  • Multiple Updates
2024-11-22 21:23:19
  • Multiple Updates
2024-11-21 21:22:56
  • Multiple Updates
2024-11-20 02:58:12
  • Multiple Updates
2024-11-14 02:58:30
  • Multiple Updates
2024-11-09 02:58:31
  • Multiple Updates
2024-10-26 02:55:55
  • Multiple Updates
2024-10-25 02:57:50
  • Multiple Updates
2024-10-23 02:57:03
  • Multiple Updates
2024-10-03 02:52:23
  • Multiple Updates
2024-10-02 02:50:47
  • Multiple Updates
2024-09-15 02:48:36
  • Multiple Updates
2024-09-12 02:48:09
  • Multiple Updates
2024-09-07 02:47:10
  • Multiple Updates
2024-09-06 02:46:22
  • Multiple Updates
2024-09-04 02:49:35
  • Multiple Updates
2024-08-22 02:47:35
  • Multiple Updates
2024-08-02 13:56:34
  • Multiple Updates
2024-08-02 01:35:47
  • Multiple Updates
2024-07-08 21:27:32
  • Multiple Updates
2024-07-05 17:27:24
  • Multiple Updates
2024-07-05 13:27:27
  • First insertion