virtiofs: use pages instead of pointer for kernel direct IO
In the Linux kernel, the following vulnerability has been resolved: virtiofs: use pages instead of pointer for kernel direct IO When trying to insert a 10MB kernel module kept in a virtio-fs with cache disabled, the following warning was reported: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 404 at mm/page_alloc.c:4551 ...... Modules linked in: CPU: 1 PID: 404 Comm: insmod Not tainted 6.9.0-rc5+ #123 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:__alloc_pages+0x2bf/0x380 ...... Call Trace: ? __warn+0x8e/0x150 ? __alloc_pages+0x2bf/0x380 __kmalloc_large_node+0x86/0x160 __kmalloc+0x33c/0x480 virtio_fs_enqueue_req+0x240/0x6d0 virtio_fs_wake_pending_and_unlock+0x7f/0x190 queue_request_and_unlock+0x55/0x60 fuse_simple_request+0x152/0x2b0 fuse_direct_io+0x5d2/0x8c0 fuse_file_read_iter+0x121/0x160 __kernel_read+0x151/0x2d0 kernel_read+0x45/0x50 kernel_read_file+0x1a9/0x2a0 init_module_from_file+0x6a/0xe0 idempotent_init_module+0x175/0x230 __x64_sys_finit_module+0x5d/0xb0 x64_sys_call+0x1c3/0x9e0 do_syscall_64+0x3d/0xc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ...... ---[ end trace 0000000000000000 ]--- The warning is triggered as follows: 1) syscall finit_module() handles the module insertion and it invokes kernel_read_file() to read the content of the module first. 2) kernel_read_file() allocates a 10MB buffer by using vmalloc() and passes it to kernel_read(). kernel_read() constructs a kvec iter by using iov_iter_kvec() and passes it to fuse_f
CVE-2024-53219
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-53219
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "a62a8ef9d97da23762a588592c8b8eb50a8deb6a",
"lessThan": "0015d54a47995867781224450525e60a1a0077ab",
"versionType": "git"
},
{
"status": "affected",
"version": "a62a8ef9d97da23762a588592c8b8eb50a8deb6a",
"lessThan": "9a8fde56d4b6d51930936ed50f6370a9097328d1",
"versionType": "git"
},
{
"status": "affected",
"version": "a62a8ef9d97da23762a588592c8b8eb50a8deb6a",
"lessThan": "2bc07714dc955a91d2923a440ea02c3cb3376b10",
"versionType": "git"
},
{
"status": "affected",
"version": "a62a8ef9d97da23762a588592c8b8eb50a8deb6a",
"lessThan": "41748675c0bf252b3c5f600a95830f0936d366c1",
"versionType": "git"
}
],
"programFiles": [
"fs/fuse/file.c",
"fs/fuse/fuse_i.h",
"fs/fuse/virtio_fs.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.4",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.11.11",
"versionType": "semver",
"lessThanOrEqual": "6.11.*"
},
{
"status": "unaffected",
"version": "6.12.2",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/fuse/file.c",
"fs/fuse/fuse_i.h",
"fs/fuse/virtio_fs.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2024-53219
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #45923 · Revision 1
- Added to Heist Feed
- Publisher date