CVE-2024-46852
Estado: ModificadaAlta (7.8)—
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Hasta que se agregó VM_DONTEXPAND en el commit 1c1914d6e8c6 ("dma-buf: heaps: Don't track CMA dma-buf pages under RssFile") era posible obtener un mapeo más grande que el tamaño del buffer a través de mremap y omitir la verificación de desbordamiento en dma_buf_mmap_internal. Al usar dicho mapeo para intentar fallar más allá del final del búfer, el manejador de fallas del montón de CMA también verifica el desplazamiento de la falla contra el tamaño del búfer, pero obtiene el límite incorrecto por 1. Corrija la verificación del límite para que no leamos el final de la matriz de páginas e insertemos una página arbitraria en el mapeo.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.21%
- Percentil entre todas las CVEs puntuadas: 11
- Fecha de la puntuación: 8/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-193
Referencias
- https://git.kernel.org/stable/c/79cce5e81d20fa9ad553be439d665ac3302d3c95
- https://git.kernel.org/stable/c/84175dc5b2c932266a50c04e5ce342c30f817a2f
- https://git.kernel.org/stable/c/e79050882b857c37634baedbdcf7c2047c24cbff
- https://git.kernel.org/stable/c/ea5ff5d351b520524019f7ff7f9ce418de2dad87
- https://git.kernel.org/stable/c/eb7fc8b65cea22f9038c52398c8b22849e9620ea
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-46852",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-46852",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2025-03-14T00:00:00+00:00"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "a5d2d29e24be8967ef78a1b1fb2292413e3b3df9",
"lessThan": "79cce5e81d20fa9ad553be439d665ac3302d3c95",
"versionType": "git"
},
{
"status": "affected",
"version": "a5d2d29e24be8967ef78a1b1fb2292413e3b3df9",
"lessThan": "84175dc5b2c932266a50c04e5ce342c30f817a2f",
"versionType": "git"
},
{
"status": "affected",
"version": "a5d2d29e24be8967ef78a1b1fb2292413e3b3df9",
"lessThan": "eb7fc8b65cea22f9038c52398c8b22849e9620ea",
"versionType": "git"
},
{
"status": "affected",
"version": "a5d2d29e24be8967ef78a1b1fb2292413e3b3df9",
"lessThan": "e79050882b857c37634baedbdcf7c2047c24cbff",
"versionType": "git"
},
{
"status": "affected",
"version": "a5d2d29e24be8967ef78a1b1fb2292413e3b3df9",
"lessThan": "ea5ff5d351b520524019f7ff7f9ce418de2dad87",
"versionType": "git"
}
],
"programFiles": [
"drivers/dma-buf/heaps/cma_heap.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.11",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.168",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.111",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.52",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.10.11",
"versionType": "semver",
"lessThanOrEqual": "6.10.*"
},
{
"status": "unaffected",
"version": "6.11",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/dma-buf/heaps/cma_heap.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2024-09-27T13:15:16.917",
"references": [
{
"url": "https://git.kernel.org/stable/c/79cce5e81d20fa9ad553be439d665ac3302d3c95",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/84175dc5b2c932266a50c04e5ce342c30f817a2f",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e79050882b857c37634baedbdcf7c2047c24cbff",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ea5ff5d351b520524019f7ff7f9ce418de2dad87",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/eb7fc8b65cea22f9038c52398c8b22849e9620ea",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-193"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf: heaps: Fix off-by-one in CMA heap fault handler\n\nUntil VM_DONTEXPAND was added in commit 1c1914d6e8c6 (\"dma-buf: heaps:\nDon't track CMA dma-buf pages under RssFile\") it was possible to obtain\na mapping larger than the buffer size via mremap and bypass the overflow\ncheck in dma_buf_mmap_internal. When using such a mapping to attempt to\nfault past the end of the buffer, the CMA heap fault handler also checks\nthe fault offset against the buffer size, but gets the boundary wrong by\n1. Fix the boundary check so that we don't read off the end of the pages\narray and insert an arbitrary page in the mapping."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dma-buf: heaps: Fix off-by-one in CMA heap fault handler Hasta que se agregó VM_DONTEXPAND en el commit 1c1914d6e8c6 (\"dma-buf: heaps: Don't track CMA dma-buf pages under RssFile\") era posible obtener un mapeo más grande que el tamaño del buffer a través de mremap y omitir la verificación de desbordamiento en dma_buf_mmap_internal. Al usar dicho mapeo para intentar fallar más allá del final del búfer, el manejador de fallas del montón de CMA también verifica el desplazamiento de la falla contra el tamaño del búfer, pero obtiene el límite incorrecto por 1. Corrija la verificación del límite para que no leamos el final de la matriz de páginas e insertemos una página arbitraria en el mapeo."
}
],
"lastModified": "2026-08-04T11:20:33.413",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D51C05D-455B-4D8D-89E7-A58E140B864C",
"versionEndExcluding": "5.15.168",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FCBCD375-91FC-4790-94C0-6FF9C68F6498",
"versionEndExcluding": "6.1.111",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "02ADDA94-95BB-484D-8E95-63C0428A28E3",
"versionEndExcluding": "6.6.52",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F5DB5367-F1F5-4200-B3B3-FDF8AFC3D255",
"versionEndExcluding": "6.10.11",
"versionStartIncluding": "6.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8B3CE743-2126-47A3-8B7C-822B502CF119"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4DEB27E7-30AA-45CC-8934-B89263EF3551"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0005AEF-856E-47EB-BFE4-90C46899394D"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39889A68-6D34-47A6-82FC-CD0BF23D6754"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8383ABF-1457-401F-9B61-EE50F4C61F4F"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B77A9280-37E6-49AD-B559-5B23A3B1DC3D"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.11:rc7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DE5298B3-04B4-4F3E-B186-01A58B5C75A6"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}