{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-56677", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-27T15:00:39.845Z", "datePublished": "2024-12-28T09:46:06.497Z", "dateUpdated": "2026-08-05T11:46:01.649Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:46:01.649Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()\n\nDuring early init CMA_MIN_ALIGNMENT_BYTES can be PAGE_SIZE,\nsince pageblock_order is still zero and it gets initialized\nlater during initmem_init() e.g.\nsetup_arch() -> initmem_init() -> sparse_init() -> set_pageblock_order()\n\nOne such use case where this causes issue is -\nearly_setup() -> early_init_devtree() -> fadump_reserve_mem() -> fadump_cma_init()\n\nThis causes CMA memory alignment check to be bypassed in\ncma_init_reserved_mem(). Then later cma_activate_area() can hit\na VM_BUG_ON_PAGE(pfn & ((1 << order) - 1)) if the reserved memory\narea was not pageblock_order aligned.\n\nFix it by moving the fadump_cma_init() after initmem_init(),\nwhere other such cma reservations also gets called.\n\n\n==============\npage: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10010\nflags: 0x13ffff800000000(node=1|zone=0|lastcpupid=0x7ffff) CMA\nraw: 013ffff800000000 5deadbeef0000100 5deadbeef0000122 0000000000000000\nraw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\npage dumped because: VM_BUG_ON_PAGE(pfn & ((1 << order) - 1))\n------------[ cut here ]------------\nkernel BUG at mm/page_alloc.c:778!\n\nCall Trace:\n__free_one_page+0x57c/0x7b0 (unreliable)\nfree_pcppages_bulk+0x1a8/0x2c8\nfree_unref_page_commit+0x3d4/0x4e4\nfree_unref_page+0x458/0x6d0\ninit_cma_reserved_pageblock+0x114/0x198\ncma_init_reserved_areas+0x270/0x3e0\ndo_one_initcall+0x80/0x2f8\nkernel_init_freeable+0x33c/0x530\nkernel_init+0x34/0x26c\nret_from_kernel_user_thread+0x14/0x1c" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is `early_setup() → early_init_devtree() → fadump_reserve_mem() → fadump_cma_init()` and the `core_initcall` CMA activation, both executing during arch boot with no network- or peer-supplied data anywhere along the way. Reaching the affected system requires local presence on a POWER machine at best.\nAC:L - On an affected ppc64 system with FA_DUMP+CMA and fadump enabled, the misalignment is deterministic — `pageblock_order` is provably zero at that point in boot, so the alignment checks in both `fadump_cma_init()` and `cma_init_reserved_mem()` are unconditionally bypassed. There is no race to win and no memory layout to groom; the failure reproduces on every boot.\nPR:L - No credentials are consumed anywhere on the path — the misaligned CMA registration and its activation happen autonomously during kernel init, before any userspace process exists to hold privileges. Scoring the highest defensible option, an unprivileged local context is assumed rather than requiring init-namespace root.\nUI:N - The corruption and the resulting BUG occur during kernel initialization at `core_initcall` time; no victim has to mount, open, or otherwise interact with anything.\nS:U - The mis-registered CMA area and the buddy-allocator damage are confined to the kernel's own memory-management authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - On production kernels (`CONFIG_DEBUG_VM=n`, the default) the `VM_BUG_ON_PAGE` is compiled out and `init_cma_reserved_pageblock()` releases pages past the CMA range end — fadump metadata/CPU-state/HPTE memory still registered with firmware — into the general buddy allocator, while misaligned entries in `free_area[pageblock_order]` let `__find_buddy_pfn()` coalesce overlapping blocks so the same physical pages are handed to multiple owners. That aliasing exposes kernel and unrelated-process memory contents to whoever receives the reused pages.\nI:H - The same misaligned free corrupts page-allocator state: `set_pageblock_migratetype()` mislabels a neighbouring pageblock, `__ClearPageReserved()` un-reserves memory the firmware still owns, and overlapping buddy blocks allow one allocation to write over another's live data. This is memory corruption of allocator metadata and of concurrently-owned pages, leveragable for arbitrary kernel memory modification.\nA:H - With `CONFIG_DEBUG_VM=y` the path hits `VM_BUG_ON_PAGE(pfn & ((1 << order) - 1))` → `kernel BUG at mm/page_alloc.c:778` during `cma_init_reserved_areas()`, panicking the kernel and leaving the machine unbootable. Without DEBUG_VM the resulting buddy-allocator inconsistency produces crashes and corruption later at runtime." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/powerpc/include/asm/fadump.h", "arch/powerpc/kernel/fadump.c", "arch/powerpc/kernel/setup-common.c" ], "versions": [ { "version": "11ac3e87ce09c27f4587a8c4fe0829d814021a82", "lessThan": "aabef6301dcf410dfd2b8759cd413b2a003c7e3f", "status": "affected", "versionType": "git" }, { "version": "11ac3e87ce09c27f4587a8c4fe0829d814021a82", "lessThan": "c5c1d1ef70834013fc3bd12b6a0f4664c6d75a74", "status": "affected", "versionType": "git" }, { "version": "11ac3e87ce09c27f4587a8c4fe0829d814021a82", "lessThan": "f551637fe9bf863386309e03f9d148d97f535ad1", "status": "affected", "versionType": "git" }, { "version": "11ac3e87ce09c27f4587a8c4fe0829d814021a82", "lessThan": "7351c5a6507b4401aeecadb5959131410a339520", "status": "affected", "versionType": "git" }, { "version": "11ac3e87ce09c27f4587a8c4fe0829d814021a82", "lessThan": "05b94cae1c47f94588c3e7096963c1007c4d9c1d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "arch/powerpc/include/asm/fadump.h", "arch/powerpc/kernel/fadump.c", "arch/powerpc/kernel/setup-common.c" ], "versions": [ { "version": "5.19", "status": "affected" }, { "version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.64", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.11", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.120" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.64" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.11.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.12.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/aabef6301dcf410dfd2b8759cd413b2a003c7e3f" }, { "url": "https://git.kernel.org/stable/c/c5c1d1ef70834013fc3bd12b6a0f4664c6d75a74" }, { "url": "https://git.kernel.org/stable/c/f551637fe9bf863386309e03f9d148d97f535ad1" }, { "url": "https://git.kernel.org/stable/c/7351c5a6507b4401aeecadb5959131410a339520" }, { "url": "https://git.kernel.org/stable/c/05b94cae1c47f94588c3e7096963c1007c4d9c1d" } ], "title": "powerpc/fadump: Move fadump_cma_init to setup_arch() after initmem_init()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:52:22.943Z" } } ] } }