Junglewise Threat Intelligence

CVE-2024-35983: Linux Kernel denial of service in bounds calculation for CONFIG_NR_CPUS

CVE-2024-35983 · Severity: medium · CVSS 5.5 · Published 2024-05-20

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel can cause certain system configurations to crash. This occurs when the system is configured with a specific number of CPUs that are a power of two, leading to an incorrect calculation of internal memory bounds. An exploit of this flaw would result in a denial-of-service, impacting the availability of the affected server or workstation.

Technical details

The vulnerability exists in kernel/bounds.c due to the use of the bits_per() function, which incorrectly rounds up to the next power of two when passed a value that is already a power of two for CONFIG_NR_CPUS. This logic error results in an incorrect number of bits being allocated for CPU-related bounds, leading to kernel panics or crashes on certain machine configurations. The issue is triggered during system operation when the kernel attempts to use these incorrectly calculated bounds. A local attacker could potentially leverage this to cause a denial-of-service. The fix replaces bits_per() with order_base_2() to ensure the correct bit count is used.

Affected products

  • Linux Linux Kernel 5.4.274 to 5.4.275, 5.10.215 to 5.10.216, 5.15.154 to 5.15.158, 6.1.84 to 6.1.90, 6.6.24 to 6.6.30, 6.7.12 to 6.8, 6.8.3 to 6.8.9

Timeline

  • 2024-04-29: patched: Initial patch submitted to the Linux kernel tree.
  • 2024-05-20: disclosed: CVE-2024-35983 published.

References

Related threats