CVE-2024-39277

What it actually does

Out-of-bounds array index in cpumask_of_node() when NUMA_NO_NODE (-1) is passed to do_map_benchmark(), causing UBSAN-detected memory corruption in the kernel topology array.

Why it matters to the business

Kernel instability or crashes during DMA mapping benchmark operations on NUMA systems; low real-world exploitability but requires patching to maintain system reliability in Linux environments.

How an attack unfolds

A local attacker with access to the map_benchmark debugfs interface invokes the ioctl with a node ID that resolves to NUMA_NO_NODE; the unchecked value reaches cpumask_of_node() and indexes the cpumask array at -1, triggering the sanitizer report and potential memory corruption.

How to fix it

Update the Linux kernel to the fixed commit b41b0018e8ca06e985e87220a618ec633988fd13 or later stable release containing the corrected cpumask_of_node handling in map_benchmark_ioctl.

How to confirm the fix worked

Confirm the running kernel contains commit b41b0018e8ca06e985e87220a618ec633988fd13; re-run dma_map_benchmark with NUMA_NO_NODE inputs and verify absence of UBSAN reports.

Typical attack path

1. Obtain local access to a system running the vulnerable kernel
2. Locate and open the dma_map_benchmark debugfs file
3. Issue an ioctl that triggers do_map_benchmark with NUMA_NO_NODE
4. Cause the cpumask_of_node call to perform the out-of-bounds access

How to detect it

Search kernel logs for UBSAN array-index-out-of-bounds reports referencing cpumask_of_node and do_map_benchmark; inspect debugfs usage and process activity invoking map_benchmark_ioctl.

What your security team should do

• Apply the kernel update containing b41b0018e8ca06e985e87220a618ec633988fd13 as soon as possible on all affected systems
• Restrict access to debugfs interfaces used by dma mapping benchmarks until patched
• Monitor for future similar NUMA handling issues in kernel benchmark code