CVE-2024-56368— ring-buffer: Fix overflow in __rb_map_vma
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于环形缓冲区模块的__rb_map_vma函数中存在溢出问题，可能导致内存损坏。
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1068 · Exploitation for Privilege EscalationAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 117c39200d9d760cbd5944bb89efb7b9c51965aa< ec12f30fe54234dd40ffee50dda8d2df10bd0871 |
affected |
117c39200d9d760cbd5944bb89efb7b9c51965aa< c58a812c8e49ad688f94f4b050ad5c5b388fc5d2 |
affected | ||
6.10 |
affected | ||
< 6.10 |
unaffected | ||
6.12.7≤ 6.12.* |
unaffected | ||
6.13≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-56368
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ring-buffer: Fix overflow in __rb_map_vma
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Fix overflow in __rb_map_vma
An overflow occurred when performing the following calculation:
nr_pages = ((nr_subbufs + 1) << subbuf_order) - pgoff;
Add a check before the calculation to avoid this problem.
syzbot reported this as a slab-out-of-bounds in __rb_map_vma:
BUG: KASAN: slab-out-of-bounds in __rb_map_vma+0x9ab/0xae0 kernel/trace/ring_buffer.c:7058
Read of size 8 at addr ffff8880767dd2b8 by task syz-executor187/5836
CPU: 0 UID: 0 PID: 5836 Comm: syz-executor187 Not tainted 6.13.0-rc2-syzkaller-00159-gf932fb9b4074 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:489
kasan_report+0xd9/0x110 mm/kasan/report.c:602
__rb_map_vma+0x9ab/0xae0 kernel/trace/ring_buffer.c:7058
ring_buffer_map+0x56e/0x9b0 kernel/trace/ring_buffer.c:7138
tracing_buffers_mmap+0xa6/0x120 kernel/trace/trace.c:8482
call_mmap include/linux/fs.h:2183 [inline]
mmap_file mm/internal.h:124 [inline]
__mmap_new_file_vma mm/vma.c:2291 [inline]
__mmap_new_vma mm/vma.c:2355 [inline]
__mmap_region+0x1786/0x2670 mm/vma.c:2456
mmap_region+0x127/0x320 mm/mmap.c:1348
do_mmap+0xc00/0xfc0 mm/mmap.c:496
vm_mmap_pgoff+0x1ba/0x360 mm/util.c:580
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:542
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The reproducer for this bug is:
------------------------8<-------------------------
#include <fcntl.h>
#include <stdlib.h>
#include <unistd.h>
#include <asm/types.h>
#include <sys/mman.h>
int main(int argc, char **argv)
{
int page_size = getpagesize();
int fd;
void *meta;
system("echo 1 > /sys/kernel/tracing/buffer_size_kb");
fd = open("/sys/kernel/tracing/per_cpu/cpu0/trace_pipe_raw", O_RDONLY);
meta = mmap(NULL, page_size, PROT_READ, MAP_SHARED, fd, page_size * 5);
}
------------------------>8-------------------------
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于环形缓冲区模块的__rb_map_vma函数中存在溢出问题，可能导致内存损坏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-56368
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-56368
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-56368 (2)
Same Patch Batch · Linux · 2025-01-11 · 67 CVEs total
| CVE-2024-49568 | 9.8 CRITICAL | net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg |
| CVE-2024-57843 | 9.8 CRITICAL | virtio-net: fix overflow inside virtnet_rq_alloc |
| CVE-2024-47408 | 9.8 CRITICAL | net/smc: check smcd_v2_ext_offset when receiving proposal msg |
| CVE-2024-57793 | 9.3 CRITICAL | virt: tdx-guest: Just leak decrypted memory on unrecoverable errors |
| CVE-2024-49571 | 9.1 CRITICAL | net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg |
| CVE-2024-55639 | 8.4 HIGH | net: renesas: rswitch: avoid use-after-put for a device tree node |
| CVE-2024-51729 | 7.8 HIGH | mm: use aligned address in copy_user_gigantic_page() |
| CVE-2024-57849 | 7.8 HIGH | s390/cpum_sf: Handle CPU hotplug remove during sampling |
| CVE-2024-57850 | 7.8 HIGH | jffs2: Prevent rtime decompress memory corruption |
| CVE-2024-52319 | 7.8 HIGH | mm: use aligned address in clear_gigantic_page() |
| CVE-2024-57875 | 7.8 HIGH | block: RCU protect disk->conv_zones_bitmap |
| CVE-2024-47794 | 7.8 HIGH | bpf: Prevent tailcall infinite loop caused by freplace |
| CVE-2024-41149 | 7.8 HIGH | block: avoid to reuse `hctx` not removed from cpuhp callback list |
| CVE-2024-49569 | 7.5 HIGH | nvme-rdma: unquiesce admin_q before destroy it |
| CVE-2024-57791 | 7.5 HIGH | net/smc: check return value of sock_recvmsg when draining clc data |
| CVE-2024-56788 | 7.5 HIGH | net: ethernet: oa_tc6: fix tx skb race condition between reference pointers |
| CVE-2024-57804 | 7.3 HIGH | scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs |
| CVE-2024-57792 | 7.3 HIGH | power: supply: gpio-charger: Fix set charge current limits |
| CVE-2024-49573 | 7.0 HIGH | sched/fair: Fix NEXT_BUDDY |
| CVE-2024-56372 | net: tun: fix tun_napi_alloc_frags() |
Showing top 20 of 67 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
Same vendor: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
V. Comments for CVE-2024-56368
No comments yet