Bug 2320194 (CVE-2024-47722)

Summary: CVE-2024-47722 kernel: xen: use correct end address of kernel for conflict checking
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: dfreiber, drow, jburrell, vkumar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
[REJECTED CVE] A memory mapping vulnerability in the Linux Kernel's xen module, affecting Xen PV dom0. The kernel failed to check the .brk section for memory conflicts with the host's memory map, potentially leading to crashes or memory corruption
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2320337    
Bug Blocks:    

Description OSIDB Bzimport 2024-10-21 13:01:10 UTC
In the Linux kernel, the following vulnerability has been resolved:

xen: use correct end address of kernel for conflict checking

When running as a Xen PV dom0 the kernel is loaded by the hypervisor
using a different memory map than that of the host. In order to
minimize the required changes in the kernel, the kernel adapts its
memory map to that of the host. In order to do that it is checking
for conflicts of its load address with the host memory map.

Unfortunately the tested memory range does not include the .brk
area, which might result in crashes or memory corruption when this
area does conflict with the memory map of the host.

Fix the test by using the _end label instead of __bss_stop.

Comment 2 TEJ RATHI 2024-11-26 10:41:05 UTC
This CVE has been rejected upstream:
https://ogma.in/understanding-cve-2024-47722-and-its-rejection-by-linux