Linux dma-buf CMA heap: off-by-one in the fault handler maps an arbitrary page past the buffer

CVSS 7.8CVE-2024-46852Kernel, userspace & hypervisorcurated

Impact

The CMA dma-buf heap fault handler compares the fault offset against the buffer size with the boundary off by one, so a mapping extended past the buffer (historically obtainable via mremap, before VM_DONTEXPAND was added) can fault in a page read from beyond the end of the pages array and insert an arbitrary page into the process mapping. dma-buf is the shared buffer plumbing accelerator and display stacks use, and a local user holding the heap device can turn this into read or write access to memory that is not theirs. On a multi-tenant GPU node, whether this is reachable depends entirely on whether /dev/dma_heap/* is exposed into containers - on a typical headless server build it is not.

Who can reach it

Local user with access to the CMA dma_heap character device. No authentication beyond that device permission; not remote. Headless GPU servers usually do not expose dma_heap to tenants.

What to do

Patch the host kernel to a stable release containing the boundary fix and reboot the node after draining. As an interim measure, confirm /dev/dma_heap/* is not mounted into tenant containers and is not world-accessible on the host.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-46852 https://git.kernel.org/stable/c/ea5ff5d351b520524019f7ff7f9ce418de2dad87 https://git.kernel.org/stable/c/eb7fc8b65cea22f9038c52398c8b22849e9620ea

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.