{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-49886", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T12:17:06.022Z", "datePublished": "2024-10-21T18:01:22.870Z", "dateUpdated": "2026-08-05T11:40:23.589Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:40:23.589Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug\n\nAttaching SST PCI device to VM causes \"BUG: KASAN: slab-out-of-bounds\".\nkasan report:\n[ 19.411889] ==================================================================\n[ 19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[ 19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113\n[ 19.417368]\n[ 19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G E 6.9.0 #10\n[ 19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022\n[ 19.422687] Call Trace:\n[ 19.424091] \n[ 19.425448] dump_stack_lvl+0x5d/0x80\n[ 19.426963] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[ 19.428694] print_report+0x19d/0x52e\n[ 19.430206] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 19.431837] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[ 19.433539] kasan_report+0xf0/0x170\n[ 19.435019] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[ 19.436709] _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common]\n[ 19.438379] ? __pfx_sched_clock_cpu+0x10/0x10\n[ 19.439910] isst_if_cpu_online+0x406/0x58f [isst_if_common]\n[ 19.441573] ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common]\n[ 19.443263] ? ttwu_queue_wakelist+0x2c1/0x360\n[ 19.444797] cpuhp_invoke_callback+0x221/0xec0\n[ 19.446337] cpuhp_thread_fun+0x21b/0x610\n[ 19.447814] ? __pfx_cpuhp_thread_fun+0x10/0x10\n[ 19.449354] smpboot_thread_fn+0x2e7/0x6e0\n[ 19.450859] ? __pfx_smpboot_thread_fn+0x10/0x10\n[ 19.452405] kthread+0x29c/0x350\n[ 19.453817] ? __pfx_kthread+0x10/0x10\n[ 19.455253] ret_from_fork+0x31/0x70\n[ 19.456685] ? __pfx_kthread+0x10/0x10\n[ 19.458114] ret_from_fork_asm+0x1a/0x30\n[ 19.459573] \n[ 19.460853]\n[ 19.462055] Allocated by task 1198:\n[ 19.463410] kasan_save_stack+0x30/0x50\n[ 19.464788] kasan_save_track+0x14/0x30\n[ 19.466139] __kasan_kmalloc+0xaa/0xb0\n[ 19.467465] __kmalloc+0x1cd/0x470\n[ 19.468748] isst_if_cdev_register+0x1da/0x350 [isst_if_common]\n[ 19.470233] isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr]\n[ 19.471670] do_one_initcall+0xa4/0x380\n[ 19.472903] do_init_module+0x238/0x760\n[ 19.474105] load_module+0x5239/0x6f00\n[ 19.475285] init_module_from_file+0xd1/0x130\n[ 19.476506] idempotent_init_module+0x23b/0x650\n[ 19.477725] __x64_sys_finit_module+0xbe/0x130\n[ 19.476506] idempotent_init_module+0x23b/0x650\n[ 19.477725] __x64_sys_finit_module+0xbe/0x130\n[ 19.478920] do_syscall_64+0x82/0x160\n[ 19.480036] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 19.481292]\n[ 19.482205] The buggy address belongs to the object at ffff888829e65000\n which belongs to the cache kmalloc-512 of size 512\n[ 19.484818] The buggy address is located 0 bytes to the right of\n allocated 512-byte region [ffff888829e65000, ffff888829e65200)\n[ 19.487447]\n[ 19.488328] The buggy address belongs to the physical page:\n[ 19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60\n[ 19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n[ 19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff)\n[ 19.493914] page_type: 0xffffffff()\n[ 19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001\n[ 19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000\n[ 19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001\n[ 19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000\n[ 19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff\n[ 19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000\n[ 19.503784] page dumped because: k\n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is reached only through a local `ioctl()` on the `/dev/isst_interface` misc device or through the local CPU-hotplug callback `isst_if_cpu_online()`; there is no network-facing consumer of `isst_if_get_pci_dev()`.\nAC:L - On an affected platform (sparse physical package IDs — any VMware/hypervisor guest with the SST PCI device attached, or gapped firmware topology) the out-of-bounds index is deterministic, and the attacker simply issues the ISST ioctl naming the relevant `logical_cpu`, reliably re-triggering it as often as desired to groom the adjacent slab.\nPR:L - The driver deliberately permits non-`CAP_SYS_ADMIN` callers down this path — `isst_if_mmio.c:53` and `isst_if_mbox_pci.c:129` gate only write/set requests, so read commands from an unprivileged process holding the device fd reach `_isst_if_get_pci_dev()` with an arbitrary CPU index and no capability check.\nUI:N - The attacker triggers the out-of-bounds access entirely on their own via ioctl, and the hotplug path fires automatically at module load with no victim action required.\nS:U - The heap corruption and wild-pointer dereference stay within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The out-of-bounds read pulls a value from an adjacent slab object and hands it back as a `struct pci_dev *`, which is then dereferenced and used to perform `readl()` at an attacker-chosen offset, yielding kernel memory/MMIO disclosure well beyond a bounded leak.\nI:H - `isst_pkg_info[pkg_id].pci_dev[bus_no] = _pci_dev` writes a kernel pointer past the end of the allocation, corrupting the neighbouring slab object, and the confused `punit_dev` can drive `writel()` at a controlled offset — both are exploitable write primitives.\nA:H - KASAN reports a slab-out-of-bounds and the resulting garbage `pci_dev` pointer is dereferenced immediately in `pci_get_drvdata()`, producing an oops/panic; on affected platforms this occurs unconditionally during CPU bring-up." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/platform/x86/intel/speed_select_if/isst_if_common.c" ], "versions": [ { "version": "017a634f9f38ae704d9d57817555773de700219e", "lessThan": "1973c4d8ee0782a808303d75e3be9c12baaacd97", "status": "affected", "versionType": "git" }, { "version": "9a1aac8a96dc014bec49806a7a964bf2fdbd315f", "lessThan": "cdd03afcb6eda3103da5a0948d3db12372f62910", "status": "affected", "versionType": "git" }, { "version": "9a1aac8a96dc014bec49806a7a964bf2fdbd315f", "lessThan": "8176d4878ed2af5d93ddd0e971e24c412124d38b", "status": "affected", "versionType": "git" }, { "version": "9a1aac8a96dc014bec49806a7a964bf2fdbd315f", "lessThan": "cebc705b097d5c16469b141a25e840161d1c517a", "status": "affected", "versionType": "git" }, { "version": "9a1aac8a96dc014bec49806a7a964bf2fdbd315f", "lessThan": "afa7f78d9a907cfded6c98c91aae2bf7b3b56e51", "status": "affected", "versionType": "git" }, { "version": "9a1aac8a96dc014bec49806a7a964bf2fdbd315f", "lessThan": "7d59ac07ccb58f8f604f8057db63b8efcebeb3de", "status": "affected", "versionType": "git" }, { "version": "5.15.115", "lessThan": "5.15.168", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/platform/x86/intel/speed_select_if/isst_if_common.c" ], "versions": [ { "version": "6.0", "status": "affected" }, { "version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.113", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.55", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.14", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.3", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.115", "versionEndExcluding": "5.15.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.6.55" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.10.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.11.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/1973c4d8ee0782a808303d75e3be9c12baaacd97" }, { "url": "https://git.kernel.org/stable/c/cdd03afcb6eda3103da5a0948d3db12372f62910" }, { "url": "https://git.kernel.org/stable/c/8176d4878ed2af5d93ddd0e971e24c412124d38b" }, { "url": "https://git.kernel.org/stable/c/cebc705b097d5c16469b141a25e840161d1c517a" }, { "url": "https://git.kernel.org/stable/c/afa7f78d9a907cfded6c98c91aae2bf7b3b56e51" }, { "url": "https://git.kernel.org/stable/c/7d59ac07ccb58f8f604f8057db63b8efcebeb3de" } ], "title": "platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-49886", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-22T13:44:59.932755Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:48:49.789Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:22:52.521Z" } } ] } }