CVE-2024-56677

What it actually does

Bypasses CMA memory alignment check in cma_init_reserved_mem due to fadump_cma_init executing before initmem_init sets pageblock_order, allowing unaligned reservations that trigger VM_BUG_ON_PAGE(pfn & ((1 << order) - 1)) in __free_one_page during cma_activate_area.

Why it matters to the business

Kernel panics on affected PowerPC systems during early boot or CMA initialization can cause unplanned downtime, service disruption, and potential loss of in-memory state; low EPSS and no KEV status indicate limited immediate widespread risk but the 653-day exposure window and listed threat actor campaigns around Linux kernel memory issues warrant attention for high-availability environments.

How an attack unfolds

An attacker leverages early boot timing on vulnerable PowerPC kernels to trigger fadump_reserve_mem before pageblock_order initialization, bypassing alignment and causing the kernel BUG during page free operations in cma_init_reserved_areas; context from 2024 zero-day campaigns and Linux kernel uninitialized resource/out-of-bounds issues by espionage and financially motivated actors applies to similar memory corruption paths.

How to fix it

Apply kernel updates that move fadump_cma_init after initmem_init; for listed affected products upgrade libreoffice (Ubuntu:14.04:LTS) to 1:4.2.8-0ubuntu5.2 and libreoffice (Ubuntu:16.04:LTS) to 1:5.1.6~rc2-0ubuntu1~xenial2.

How to confirm the fix worked

Confirm kernel source contains fadump_cma_init call after initmem_init in setup_arch; verify no VM_BUG_ON_PAGE hits during cma_init_reserved_areas on boot with CMA enabled; check package versions match the fixed libreoffice releases.

Typical attack path

1. Obtain local or boot-time access on PowerPC Linux system
2. Influence or wait for early_setup/early_init_devtree to call fadump_cma_init before initmem_init
3. Trigger CMA reservation with non-pageblock_order alignment
4. Cause subsequent page free operations to hit VM_BUG_ON in mm/page_alloc.c

How to detect it

Review kernel boot logs and dmesg for VM_BUG_ON_PAGE messages referencing page_alloc.c:778 or CMA flags; inspect early init call traces involving fadump_cma_init and cma_init_reserved_areas; correlate with threat actor TTPs around Linux kernel out-of-bounds or uninitialized resource issues.

What your security team should do

• Prioritize patching affected PowerPC kernels and listed libreoffice packages within normal change windows given absence of KEV or ransomware usage
• Monitor EPSS trend stability and threat actor mentions of Linux kernel memory flaws for any increase in targeting
• Test boot paths with fadump and CMA on PowerPC hardware to validate alignment fixes