CVE-2024-36019

What it actually does

Out-of-bounds indexing in regcache_maple_drop() causes kernel memory to be copied over regmap cache contents when retaining the upper end of a cache block.

Why it matters to the business

Linux kernel systems using regmap with the maple cache can experience cache corruption, leading to unexpected hardware behavior, system instability, or crashes in affected environments.

How an attack unfolds

An attacker with the ability to trigger regmap cache drop operations on non-zero-based register blocks can cause memory corruption; named threat actors associated with Android kernel remote code execution may seek to chain this flaw with other primitives for privilege escalation.

How to fix it

Update the Linux kernel to the fixed commit 3af6c5ac72dc5b721058132a0a1d7779e443175e or later stable releases containing the patch; rebuild and deploy updated kernel images across affected systems.

How to confirm the fix worked

Verify the presence of commit 3af6c5ac72dc5b721058132a0a1d7779e443175e in the kernel source tree; run regmap KUnit tests with non-zero-based register blocks and confirm no cache corruption occurs.

Typical attack path

1. Identify systems using regmap maple cache with register blocks not starting at offset zero
2. Trigger cache drop operations that retain the upper portion of a block entry
3. Cause out-of-bounds read that overwrites cache memory with unrelated kernel data
4. Leverage resulting corruption to influence hardware register operations or escalate privileges

How to detect it

Review kernel logs for regmap or maple cache related faults and oops messages; examine crash dumps for signs of memory overwrites originating from regcache_maple_drop; correlate with threat actor activity targeting Android kernel components.

What your security team should do

• Apply the kernel patch containing commit 3af6c5ac72dc5b721058132a0a1d7779e443175e immediately on all Linux distributions using regmap
• Prioritize updates for systems handling hardware registers or in embedded/Android environments
• Monitor for kernel oops or regmap-related crashes post-deployment