CVE-2024-46847

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-46847", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-11T15:12:18.290Z", "datePublished": "2024-09-27T12:39:39.550Z", "dateUpdated": "2026-08-05T11:38:58.890Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:38:58.890Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: vmalloc: ensure vmap_block is initialised before adding to queue\n\nCommit 8c61291fd850 (\"mm: fix incorrect vbq reference in\npurge_fragmented_block\") extended the 'vmap_block' structure to contain a\n'cpu' field which is set at allocation time to the id of the initialising\nCPU.\n\nWhen a new 'vmap_block' is being instantiated by new_vmap_block(), the\npartially initialised structure is added to the local 'vmap_block_queue'\nxarray before the 'cpu' field has been initialised. If another CPU is\nconcurrently walking the xarray (e.g. via vm_unmap_aliases()), then it\nmay perform an out-of-bounds access to the remote queue thanks to an\nuninitialised index.\n\nThis has been observed as UBSAN errors in Android:\n\n | Internal error: UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP\n |\n | Call trace:\n | purge_fragmented_block+0x204/0x21c\n | _vm_unmap_aliases+0x170/0x378\n | vm_unmap_aliases+0x1c/0x28\n | change_memory_common+0x1dc/0x26c\n | set_memory_ro+0x18/0x24\n | module_enable_ro+0x98/0x238\n | do_init_module+0x1b0/0x310\n\nMove the initialisation of 'vb->cpu' in new_vmap_block() ahead of the\naddition to the xarray."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is core mm/vmalloc block allocation, reached through ordinary local syscall activity (read/write of compressed f2fs/erofs files, dma-buf/V4L2 buffer mapping, vmalloc/vfree churn). No network protocol handler reaches it.\nAC:L - The attacker controls both sides of the race \u2014 one thread drives vm_map_ram()/new_vmap_block() while another drives vm_unmap_aliases() on a different CPU \u2014 and the window is fully preemptible (no locks held, RCU section already exited), so it can be widened and retried indefinitely; it was observed triggering spontaneously in production Android without any attacker.\nPR:L - Every path to both sides of the race (f2fs/erofs compressed file I/O, udmabuf, videobuf2, vfree of VM_FLUSH_RESET_PERMS areas) is available to a plain unprivileged local user with no capability check anywhere along the trace.\nUI:N - The attacker's own threads perform all required operations; no victim action, mount, or file open by another user is needed.\nS:U - The uninitialized read, the out-of-bounds array access and the resulting crash all occur within the kernel's own security authority, with no crossing of a VM, IOMMU or sandbox boundary.\nC:H - __per_cpu_offset[vb->cpu] is an out-of-bounds read with an unbounded 32-bit index (up to ~32 GiB past the array) that is attacker-groomable, since struct vmap_block lands in kmalloc-256 and the uninitialized cpu field can be pre-seeded via heap spray \u2014 an attacker-directed read of arbitrary kernel memory, not a bounded few-byte overread.\nI:H - The out-of-bounds load produces a fully wild vmap_block_queue pointer built from attacker-influenceable data, which is subsequently used as a lock/list target inside purge_fragmented_block(), giving corruption of memory at an attacker-steered offset.\nA:H - The bug is a confirmed kernel panic \u2014 UBSAN array-index trap on Android, or an unhandled kernel page fault on the wild __per_cpu_offset[] load \u2014 and the oops happens while holding vmap_purge_lock and vb->lock inside an RCU read section, permanently deadlocking the vmap layer for all subsequent vmalloc/vfree."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/vmalloc.c"], "versions": [{"version": "88e0ad40d08a73a74c597e69f4cd2d1fba3838b5", "lessThan": "1b2770e27d6d952f491bb362b657e5b2713c3efd", "status": "affected", "versionType": "git"}, {"version": "8c61291fd8500e3b35c7ec0c781b273d8cc96cde", "lessThan": "6cf74e0e5e3ab5d5c9defb4c73dad54d52224671", "status": "affected", "versionType": "git"}, {"version": "8c61291fd8500e3b35c7ec0c781b273d8cc96cde", "lessThan": "3e3de7947c751509027d26b679ecd243bc9db255", "status": "affected", "versionType": "git"}, {"version": "9983b81579be3403f5cc44b11f66c6c8bea6547f", "status": "affected", "versionType": "git"}, {"version": "6.6.37", "lessThan": "6.6.51", "status": "affected", "versionType": "semver"}, {"version": "6.9.8", "lessThan": "6.10", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["mm/vmalloc.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.51", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.10", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.37", "versionEndExcluding": "6.6.51"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.10.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1b2770e27d6d952f491bb362b657e5b2713c3efd"}, {"url": "https://git.kernel.org/stable/c/6cf74e0e5e3ab5d5c9defb4c73dad54d52224671"}, {"url": "https://git.kernel.org/stable/c/3e3de7947c751509027d26b679ecd243bc9db255"}], "title": "mm: vmalloc: ensure vmap_block is initialised before adding to queue", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-29T13:58:55.254929Z", "id": "CVE-2024-46847", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T13:58:59.658Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-46847", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-29T13:58:55.254929Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T13:58:56.460Z"}}], "cna": {"title": "mm: vmalloc: ensure vmap_block is initialised before adding to queue", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is core mm/vmalloc block allocation, reached through ordinary local syscall activity (read/write of compressed f2fs/erofs files, dma-buf/V4L2 buffer mapping, vmalloc/vfree churn). No network protocol handler reaches it.\nAC:L - The attacker controls both sides of the race \u2014 one thread drives vm_map_ram()/new_vmap_block() while another drives vm_unmap_aliases() on a different CPU \u2014 and the window is fully preemptible (no locks held, RCU section already exited), so it can be widened and retried indefinitely; it was observed triggering spontaneously in production Android without any attacker.\nPR:L - Every path to both sides of the race (f2fs/erofs compressed file I/O, udmabuf, videobuf2, vfree of VM_FLUSH_RESET_PERMS areas) is available to a plain unprivileged local user with no capability check anywhere along the trace.\nUI:N - The attacker's own threads perform all required operations; no victim action, mount, or file open by another user is needed.\nS:U - The uninitialized read, the out-of-bounds array access and the resulting crash all occur within the kernel's own security authority, with no crossing of a VM, IOMMU or sandbox boundary.\nC:H - __per_cpu_offset[vb->cpu] is an out-of-bounds read with an unbounded 32-bit index (up to ~32 GiB past the array) that is attacker-groomable, since struct vmap_block lands in kmalloc-256 and the uninitialized cpu field can be pre-seeded via heap spray \u2014 an attacker-directed read of arbitrary kernel memory, not a bounded few-byte overread.\nI:H - The out-of-bounds load produces a fully wild vmap_block_queue pointer built from attacker-influenceable data, which is subsequently used as a lock/list target inside purge_fragmented_block(), giving corruption of memory at an attacker-steered offset.\nA:H - The bug is a confirmed kernel panic \u2014 UBSAN array-index trap on Android, or an unhandled kernel page fault on the wild __per_cpu_offset[] load \u2014 and the oops happens while holding vmap_purge_lock and vb->lock inside an RCU read section, permanently deadlocking the vmap layer for all subsequent vmalloc/vfree."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "88e0ad40d08a73a74c597e69f4cd2d1fba3838b5", "lessThan": "1b2770e27d6d952f491bb362b657e5b2713c3efd", "versionType": "git"}, {"status": "affected", "version": "8c61291fd8500e3b35c7ec0c781b273d8cc96cde", "lessThan": "6cf74e0e5e3ab5d5c9defb4c73dad54d52224671", "versionType": "git"}, {"status": "affected", "version": "8c61291fd8500e3b35c7ec0c781b273d8cc96cde", "lessThan": "3e3de7947c751509027d26b679ecd243bc9db255", "versionType": "git"}, {"status": "affected", "version": "9983b81579be3403f5cc44b11f66c6c8bea6547f", "versionType": "git"}, {"status": "affected", "version": "6.6.37", "lessThan": "6.6.51", "versionType": "semver"}, {"status": "affected", "version": "6.9.8", "lessThan": "6.10", "versionType": "semver"}], "programFiles": ["mm/vmalloc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"status": "unaffected", "version": "0", "lessThan": "6.10", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.51", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.10.10", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["mm/vmalloc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/1b2770e27d6d952f491bb362b657e5b2713c3efd"}, {"url": "https://git.kernel.org/stable/c/6cf74e0e5e3ab5d5c9defb4c73dad54d52224671"}, {"url": "https://git.kernel.org/stable/c/3e3de7947c751509027d26b679ecd243bc9db255"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: vmalloc: ensure vmap_block is initialised before adding to queue\n\nCommit 8c61291fd850 (\"mm: fix incorrect vbq reference in\npurge_fragmented_block\") extended the 'vmap_block' structure to contain a\n'cpu' field which is set at allocation time to the id of the initialising\nCPU.\n\nWhen a new 'vmap_block' is being instantiated by new_vmap_block(), the\npartially initialised structure is added to the local 'vmap_block_queue'\nxarray before the 'cpu' field has been initialised. If another CPU is\nconcurrently walking the xarray (e.g. via vm_unmap_aliases()), then it\nmay perform an out-of-bounds access to the remote queue thanks to an\nuninitialised index.\n\nThis has been observed as UBSAN errors in Android:\n\n | Internal error: UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP\n |\n | Call trace:\n | purge_fragmented_block+0x204/0x21c\n | _vm_unmap_aliases+0x170/0x378\n | vm_unmap_aliases+0x1c/0x28\n | change_memory_common+0x1dc/0x26c\n | set_memory_ro+0x18/0x24\n | module_enable_ro+0x98/0x238\n | do_init_module+0x1b0/0x310\n\nMove the initialisation of 'vb->cpu' in new_vmap_block() ahead of the\naddition to the xarray."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.51", "versionStartIncluding": "6.6.37"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.10", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.9.8"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:38:58.890Z"}}}, "cveMetadata": {"cveId": "CVE-2024-46847", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:38:58.890Z", "dateReserved": "2024-09-11T15:12:18.290Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-09-27T12:39:39.550Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["mm/vmalloc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1b2770e27d6d952f491bb362b657e5b2713c3efd", "status": "affected", "version": "88e0ad40d08a73a74c597e69f4cd2d1fba3838b5", "versionType": "git"}, {"lessThan": "6cf74e0e5e3ab5d5c9defb4c73dad54d52224671", "status": "affected", "version": "8c61291fd8500e3b35c7ec0c781b273d8cc96cde", "versionType": "git"}, {"lessThan": "3e3de7947c751509027d26b679ecd243bc9db255", "status": "affected", "version": "8c61291fd8500e3b35c7ec0c781b273d8cc96cde", "versionType": "git"}, {"status": "affected", "version": "9983b81579be3403f5cc44b11f66c6c8bea6547f", "versionType": "git"}, {"lessThan": "6.6.51", "status": "affected", "version": "6.6.37", "versionType": "semver"}, {"lessThan": "6.10", "status": "affected", "version": "6.9.8", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["mm/vmalloc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.51", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2E729F4-60BE-4AE1-8378-4DA2AE9E4651", "versionEndExcluding": "6.6.51", "versionStartIncluding": "6.6.37", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7CD11465-AFC4-428F-A933-C8F6486DDC2F", "versionEndExcluding": "6.10", "versionStartIncluding": "6.9.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D16659A9-BECD-4E13-8994-B096652762E2", "versionEndExcluding": "6.10.10", "versionStartIncluding": "6.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*", "matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*", "matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*", "matchCriteriaId": "E0005AEF-856E-47EB-BFE4-90C46899394D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*", "matchCriteriaId": "39889A68-6D34-47A6-82FC-CD0BF23D6754", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*", "matchCriteriaId": "B8383ABF-1457-401F-9B61-EE50F4C61F4F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*", "matchCriteriaId": "B77A9280-37E6-49AD-B559-5B23A3B1DC3D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: vmalloc: ensure vmap_block is initialised before adding to queue\n\nCommit 8c61291fd850 (\"mm: fix incorrect vbq reference in\npurge_fragmented_block\") extended the 'vmap_block' structure to contain a\n'cpu' field which is set at allocation time to the id of the initialising\nCPU.\n\nWhen a new 'vmap_block' is being instantiated by new_vmap_block(), the\npartially initialised structure is added to the local 'vmap_block_queue'\nxarray before the 'cpu' field has been initialised. If another CPU is\nconcurrently walking the xarray (e.g. via vm_unmap_aliases()), then it\nmay perform an out-of-bounds access to the remote queue thanks to an\nuninitialised index.\n\nThis has been observed as UBSAN errors in Android:\n\n | Internal error: UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP\n |\n | Call trace:\n | purge_fragmented_block+0x204/0x21c\n | _vm_unmap_aliases+0x170/0x378\n | vm_unmap_aliases+0x1c/0x28\n | change_memory_common+0x1dc/0x26c\n | set_memory_ro+0x18/0x24\n | module_enable_ro+0x98/0x238\n | do_init_module+0x1b0/0x310\n\nMove the initialisation of 'vb->cpu' in new_vmap_block() ahead of the\naddition to the xarray."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: vmalloc: garantizar que vmap_block se inicialice antes de agregarlo a la cola. El commit 8c61291fd850 (\"mm: corregir referencia vbq incorrecta en purge_fragmented_block\") extendi\u00f3 la estructura 'vmap_block' para que contenga un campo 'cpu' que se establece en el momento de la asignaci\u00f3n en el id de la CPU que se inicializa. Cuando se crea una instancia de 'vmap_block' mediante new_vmap_block(), la estructura parcialmente inicializada se agrega a la matriz x local 'vmap_block_queue' antes de que se haya inicializado el campo 'cpu'. Si otra CPU est\u00e1 recorriendo simult\u00e1neamente la matriz x (por ejemplo, a trav\u00e9s de vm_unmap_aliases()), puede realizar un acceso fuera de los l\u00edmites a la cola remota gracias a un \u00edndice no inicializado. Esto se ha observado como errores UBSAN en Android: | Error interno: UBSAN: \u00edndice de matriz fuera de los l\u00edmites: 00000000f2005512 [#1] PREEMPT SMP | | Rastreo de llamadas: | purge_fragmented_block+0x204/0x21c | _vm_unmap_aliases+0x170/0x378 | vm_unmap_aliases+0x1c/0x28 | change_memory_common+0x1dc/0x26c | set_memory_ro+0x18/0x24 | module_enable_ro+0x98/0x238 | do_init_module+0x1b0/0x310 Mueva la inicializaci\u00f3n de 'vb->cpu' en new_vmap_block() antes de la adici\u00f3n a la matriz x."}], "id": "CVE-2024-46847", "lastModified": "2026-08-04T11:20:32.823", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-46847", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-29T13:58:55.254929Z", "version": "2.0.3"}}]}, "published": "2024-09-27T13:15:16.570", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1b2770e27d6d952f491bb362b657e5b2713c3efd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3e3de7947c751509027d26b679ecd243bc9db255"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6cf74e0e5e3ab5d5c9defb4c73dad54d52224671"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-129"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: mm: vmalloc: ensure vmap_block is initialised before adding to queue", "id": "2315199", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315199"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-129", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmm: vmalloc: ensure vmap_block is initialised before adding to queue\nCommit 8c61291fd850 (\"mm: fix incorrect vbq reference in\npurge_fragmented_block\") extended the 'vmap_block' structure to contain a\n'cpu' field which is set at allocation time to the id of the initialising\nCPU.\nWhen a new 'vmap_block' is being instantiated by new_vmap_block(), the\npartially initialised structure is added to the local 'vmap_block_queue'\nxarray before the 'cpu' field has been initialised. If another CPU is\nconcurrently walking the xarray (e.g. via vm_unmap_aliases()), then it\nmay perform an out-of-bounds access to the remote queue thanks to an\nuninitialised index.\nThis has been observed as UBSAN errors in Android:\n| Internal error: UBSAN: array index out of bounds: 00000000f2005512 [#1] PREEMPT SMP\n|\n| Call trace:\n| purge_fragmented_block+0x204/0x21c\n| _vm_unmap_aliases+0x170/0x378\n| vm_unmap_aliases+0x1c/0x28\n| change_memory_common+0x1dc/0x26c\n| set_memory_ro+0x18/0x24\n| module_enable_ro+0x98/0x238\n| do_init_module+0x1b0/0x310\nMove the initialisation of 'vb->cpu' in new_vmap_block() ahead of the\naddition to the xarray."], "name": "CVE-2024-46847", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-09-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-46847\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-46847\nhttps://lore.kernel.org/linux-cve-announce/2024092756-CVE-2024-46847-e469@gregkh/T"], "threat_severity": "Moderate"}

{}