{"id":"CVE-2024-57945","summary":"riscv: mm: Fix the out of bound issue of vmemmap address","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: mm: Fix the out of bound issue of vmemmap address\n\nIn sparse vmemmap model, the virtual address of vmemmap is calculated as:\n((struct page *)VMEMMAP_START - (phys_ram_base \u003e\u003e PAGE_SHIFT)).\nAnd the struct page's va can be calculated with an offset:\n(vmemmap + (pfn)).\n\nHowever, when initializing struct pages, kernel actually starts from the\nfirst page from the same section that phys_ram_base belongs to. If the\nfirst page's physical address is not (phys_ram_base \u003e\u003e PAGE_SHIFT), then\nwe get an va below VMEMMAP_START when calculating va for it's struct page.\n\nFor example, if phys_ram_base starts from 0x82000000 with pfn 0x82000, the\nfirst page in the same section is actually pfn 0x80000. During\ninit_unavailable_range(), we will initialize struct page for pfn 0x80000\nwith virtual address ((struct page *)VMEMMAP_START - 0x2000), which is\nbelow VMEMMAP_START as well as PCI_IO_END.\n\nThis commit fixes this bug by introducing a new variable\n'vmemmap_start_pfn' which is aligned with memory section size and using\nit to calculate vmemmap address instead of phys_ram_base.","modified":"2026-04-16T04:31:04.201381802Z","published":"2025-01-21T12:18:12.548Z","related":["USN-7379-2","USN-7380-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/57xxx/CVE-2024-57945.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/92f08673d3f1893191323572f60e3c62f2e57c2f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a4a7ac3d266008018f05fae53060fcb331151a14"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d2bd51954ac8377c2f1eb1813e694788998add66"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f754f27e98f88428aaf6be6e00f5cbce97f62d4b"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/57xxx/CVE-2024-57945.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57945"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"8310080799b40fd9f2a8b808c657269678c149af"},{"fixed":"92f08673d3f1893191323572f60e3c62f2e57c2f"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a278d5c60f21aa15d540abb2f2da6e6d795c3e6e"},{"fixed":"a4a7ac3d266008018f05fae53060fcb331151a14"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a11dd49dcb9376776193e15641f84fcc1e5980c9"},{"fixed":"d2bd51954ac8377c2f1eb1813e694788998add66"},{"fixed":"f754f27e98f88428aaf6be6e00f5cbce97f62d4b"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0"},{"last_affected":"8af1c121b0102041809bc137ec600d1865eaeedd"},{"last_affected":"5941a90c55d3bfba732b32208d58d997600b44ef"},{"last_affected":"2a1728c15ec4f45ed9248ae22f626541c179bfbe"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-57945.json"}}],"schema_version":"1.7.5"}