Junglewise Threat Intelligence

CVE-2024-35988: Linux Kernel RISC-V incorrect TASK_SIZE in 64-bit NOMMU

CVE-2024-35988 · Severity: medium · CVSS 5.5 · Published 2024-05-20

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel for RISC-V systems that do not use a Memory Management Unit (NOMMU). On systems with more than 4GB of RAM, the kernel incorrectly limits the size of user memory tasks, which can lead to system instability or failures when applications try to access memory. This could potentially be used by a local attacker to cause a denial-of-service condition.

Technical details

The vulnerability stems from an incorrect definition of the TASK_SIZE macro in arch/riscv/include/asm/pgtable.h for 64-bit NOMMU (No Memory Management Unit) configurations. In NOMMU mode, userspace memory is not restricted to a specific virtual range and can reside anywhere in physical RAM. The previous definition hardcoded TASK_SIZE to 0xffffffffUL (4GB), which caused the kernel's userspace access routines (like copy_to_user/copy_from_user) to fail or behave unpredictably if physical RAM was located above the 4GB address space. An attacker with local access could potentially trigger these failures to cause a kernel-level denial of service. The fix updates TASK_SIZE to cover the full 64-bit address space.

Affected products

  • Linux Linux Kernel 5.5 to 5.10.216, 5.11 to 5.15.158, 5.16 to 6.1.90, 6.2 to 6.6.30, 6.7 to 6.8.9, 6.9-rc1 to 6.9-rc5

Timeline

  • 2024-05-20: disclosed: Initial publication of the CVE record
  • 2024-05-20: advisory: NVD publication date

References

Related threats