CVE-2024-46852

What it actually does

Off-by-one boundary check error in the CMA heap fault handler allows a fault offset to exceed the buffer size by one, resulting in an out-of-bounds read from the pages array and insertion of an arbitrary page into the mapping.

Why it matters to the business

Local attackers on affected Linux systems can potentially achieve privilege escalation or memory corruption, leading to compromised hosts, data exposure, or service disruption in environments relying on dma-buf CMA heaps.

How an attack unfolds

An attacker first obtains a dma-buf mapping via the CMA heap, uses mremap to expand it beyond the intended size (bypassing the earlier dma_buf_mmap_internal check), then triggers a page fault past the buffer end; the faulty boundary check permits reading beyond the pages array and mapping an attacker-controlled page.

How to fix it

Upgrade the Linux kernel to a version containing commit 79cce5e81d20fa9ad553be439d665ac3302d3c95 or later; apply the same fix to any downstream distributions or rebuilds. Ensure all affected systems receive the kernel update promptly given the high local impact.

How to confirm the fix worked

Confirm the running kernel contains commit 79cce5e81d20fa9ad553be439d665ac3302d3c95 or equivalent; review dma-buf heap fault handler code for the corrected boundary check against buffer size; test with mremap scenarios to verify no out-of-bounds access occurs.

Typical attack path

1. Allocate a CMA dma-buf and obtain a mapping
2. Use mremap to create a mapping larger than the buffer
3. Trigger a fault at the off-by-one offset past the buffer end
4. Cause the handler to read beyond the pages array and insert arbitrary page
5. Leverage the resulting mapping for further exploitation such as privilege escalation

How to detect it

Review kernel logs for page fault errors or warnings originating from dma_buf_fault or CMA heap handlers; inspect for unusual mremap activity followed by mapping anomalies; correlate with process activity attempting to expand dma-buf mappings.

What your security team should do

• Prioritize kernel updates on all Linux systems using dma-buf CMA heaps
• Monitor for local privilege escalation attempts on multi-user systems
• Review and restrict use of mremap on dma-buf mappings where possible
• Apply compensating controls such as kernel hardening features until patched