Description
In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Until VM_DONTEXPAND was added in commit 1c1914d6e8c6 ("dma-buf: heaps: Don't track CMA dma-buf pages under RssFile") it was possible to obtain a mapping larger than the buffer size via mremap and bypass the overflow check in dma_buf_mmap_internal. When using such a mapping to attempt to fault past the end of the buffer, the CMA heap fault handler also checks the fault offset against the buffer size, but gets the boundary wrong by 1. Fix the boundary check so that we don't read off the end of the pages array and insert an arbitrary page in the mapping.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
a5d2d29e24be8967ef78a1b1fb2292413e3b3df9 to < 79cce5e81d20fa9ad553be439d665ac3302d3c95affecteda5d2d29e24be8967ef78a1b1fb2292413e3b3df9 to < 84175dc5b2c932266a50c04e5ce342c30f817a2faffecteda5d2d29e24be8967ef78a1b1fb2292413e3b3df9 to < eb7fc8b65cea22f9038c52398c8b22849e9620eaaffecteda5d2d29e24be8967ef78a1b1fb2292413e3b3df9 to < e79050882b857c37634baedbdcf7c2047c24cbffaffecteda5d2d29e24be8967ef78a1b1fb2292413e3b3df9 to < ea5ff5d351b520524019f7ff7f9ce418de2dad87affected
Linux Linux
Default version status: affected
5.11affected0 to < 5.11unaffected5.15.168 to ≤ 5.15.*unaffected6.1.111 to ≤ 6.1.*unaffected6.6.52 to ≤ 6.6.*unaffected6.10.11 to ≤ 6.10.*unaffected6.11 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/79cce5e81d20fa9ad553be439d665ac3302d3c95 ↗
- https://git.kernel.org/stable/c/84175dc5b2c932266a50c04e5ce342c30f817a2f ↗
- https://git.kernel.org/stable/c/eb7fc8b65cea22f9038c52398c8b22849e9620ea ↗
- https://git.kernel.org/stable/c/e79050882b857c37634baedbdcf7c2047c24cbff ↗
- https://git.kernel.org/stable/c/ea5ff5d351b520524019f7ff7f9ce418de2dad87 ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗