CVE-2024-46689

MEDIUM

Linux Kernel 4.18-6.10.8 - Out-of-bounds Write in cmd-db Memory Mapping

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: soc: qcom: cmd-db: Map shared memory as WC, not WB Linux does not write into cmd-db region. This region of memory is write protected by XPU. XPU may sometime falsely detect clean cache eviction as "write" into the write protected region leading to secure interrupt which causes an endless loop somewhere in Trust Zone. The only reason it is working right now is because Qualcomm Hypervisor maps the same region as Non-Cacheable memory in Stage 2 translation tables. The issue manifests if we want to use another hypervisor (like Xen or KVM), which does not know anything about those specific mappings. Changing the mapping of cmd-db memory from MEMREMAP_WB to MEMREMAP_WT/WC removes dependency on correct mappings in Stage 2 tables. This patch fixes the issue by updating the mapping to MEMREMAP_WC. I tested this on SA8155P with Xen.

Scores

CVSS v3 5.5
EPSS 0.0024
EPSS Percentile 14.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-787
Status published
Products (24)
linux/Kernel 4.18.0 - 5.4.283linux
linux/Kernel 5.11.0 - 5.15.166linux
linux/Kernel 5.16.0 - 6.1.108linux
linux/Kernel 5.5.0 - 5.10.225linux
linux/Kernel 6.2.0 - 6.6.49linux
linux/Kernel 6.7.0 - 6.10.8linux
Linux/Linux < 4.18
Linux/Linux 312416d9171a1460b7ed8d182b5b540c910ce80d - 0ee9594c974368a17e85a431e9fe1c14fb65c278
Linux/Linux 312416d9171a1460b7ed8d182b5b540c910ce80d - 62c2d63605ca25b5db78a347ed303c0a0a77d5b4
Linux/Linux 312416d9171a1460b7ed8d182b5b540c910ce80d - d9d48d70e922b272875cda60d2ada89291c840cf
... and 14 more
Published Sep 13, 2024
Tracked Since Feb 18, 2026