2024-05-17 17:55:24

by Michal Koutný

[permalink] [raw]
Subject: Re: CVE-2024-27406: lib/Kconfig.debug: TEST_IOV_ITER depends on MMU

On Fri, May 17, 2024 at 01:40:41PM GMT, Greg Kroah-Hartman <[email protected]> wrote:
> BUG: failure at mm/nommu.c:318/vmap()!
> Kernel panic - not syncing: BUG!
>
> The test calls vmap() directly, but vmap() is not supported on nommu
> systems, causing the crash. TEST_IOV_ITER therefore needs to depend on
> MMU.

This is fixing mising assumption of a testing module.
The BUG is deserved AFAIU. The CVE should be reverted IMO.


Thanks,
Michal


Attachments:
(No filename) (471.00 B)
signature.asc (235.00 B)
Download all attachments

2024-05-19 08:53:22

by Greg Kroah-Hartman

[permalink] [raw]
Subject: Re: CVE-2024-27406: lib/Kconfig.debug: TEST_IOV_ITER depends on MMU

On Fri, May 17, 2024 at 07:42:14PM +0200, Michal Koutn? wrote:
> On Fri, May 17, 2024 at 01:40:41PM GMT, Greg Kroah-Hartman <[email protected]> wrote:
> > BUG: failure at mm/nommu.c:318/vmap()!
> > Kernel panic - not syncing: BUG!
> >
> > The test calls vmap() directly, but vmap() is not supported on nommu
> > systems, causing the crash. TEST_IOV_ITER therefore needs to depend on
> > MMU.
>
> This is fixing mising assumption of a testing module.
> The BUG is deserved AFAIU. The CVE should be reverted IMO.

Many people/distros run the built-in unit tests at boot time, and having
crashes is not a good idea. So if you don't enable this option, great,
this CVE isn't relevent, but if you do, it's an in-kernel crash which is
not good, and this is the fix for that.

So I don't think this CVE should be rejected, sorry.

thanks,

greg k-h