CVE-2024-57945

What it actually does

The vulnerability allows calculation of a virtual address for struct page below VMEMMAP_START during initialization of unavailable memory ranges in the sparse vmemmap model on RISC-V, resulting in out-of-bounds memory access.

Why it matters to the business

Systems running affected Linux kernels on RISC-V architecture may experience kernel instability, crashes, or memory corruption, disrupting operations on servers, embedded devices, or cloud workloads.

How an attack unfolds

An attacker with local access triggers the flawed vmemmap address calculation during kernel memory initialization on RISC-V, leading to out-of-bounds access that can be leveraged for memory corruption or information disclosure.

How to fix it

Upgrade the Linux kernel to the fixed commit df0cc57e057f18e44dac8e6c18aba47ab53202f9 or later versions that align vmemmap_start_pfn with memory section size.

How to confirm the fix worked

Confirm the kernel source includes the vmemmap_start_pfn variable aligned to memory section size and that no vmemmap addresses are calculated below VMEMMAP_START during init.

Typical attack path

1. Obtain local user access on an affected RISC-V Linux system
2. Trigger kernel memory initialization paths involving init_unavailable_range
3. Exploit resulting out-of-bounds vmemmap access for corruption or disclosure

How to detect it

Review kernel boot logs and dmesg on RISC-V systems for errors or panics involving vmemmap address calculations below expected start addresses.

What your security team should do

• Apply the kernel patch or update to a fixed version immediately on RISC-V systems
• Prioritize patching in high-availability or production RISC-V deployments
• Test updated kernels in staging before broad rollout
• Monitor upstream Linux kernel releases for RISC-V memory fixes