Detections
Analytics

Google: sys-kernel/lakitu-kernel-6_1, sys-kernel/lakitu-kernel-6_6: security update to 18613.75.4

medium Tenable Self-Hosted Container Security Plugin ID 471675

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: resource: fix region_intersects() vs
 add_memory_driver_managed() On a system with CXL memory, the resource tree (/proc/iomem) related to CXL
 memory may look like something as follows. 490000000-50fffffff : CXL Window 0 490000000-50fffffff :
 region0 490000000-50fffffff : dax0.0 490000000-50fffffff : System RAM (kmem) Because drivers/dax/kmem.c
 calls add_memory_driver_managed() during onlining CXL memory, which makes "System RAM (kmem)" a descendant
 of "CXL Window X". This confuses region_intersects(), which expects all "System RAM" resources to be at
 the top level of iomem_resource. This can lead to bugs. For example, when the following command line is
 executed to write some memory in CXL memory range via /dev/mem, $ dd if=data of=/dev/mem bs=$((1 << 10))
 seek=$((0x490000000 >> 10)) count=1 dd: error writing '/dev/mem': Bad address 1+0 records in 0+0 records
 out 0 bytes copied, 0.0283507 s, 0.0 kB/s the command fails as expected. However, the error code is wrong.
 It should be "Operation not permitted" instead of "Bad address". More seriously, the /dev/mem permission
 checking in devmem_is_allowed() passes incorrectly. Although the accessing is prevented later because
 ioremap() isn't allowed to map system RAM, it is a potential security issue. During command executing, the
 following warning is reported in the kernel log for calling ioremap() on system RAM. ioremap on RAM at
 0x0000000490000000 - 0x0000000490000fff WARNING: CPU: 2 PID: 416 at arch/x86/mm/ioremap.c:216
 __ioremap_caller.constprop.0+0x131/0x35d Call Trace: memremap+0xcb/0x184 xlate_dev_mem_ptr+0x25/0x2f
 write_mem+0x94/0xfb vfs_write+0x128/0x26d ksys_write+0xac/0xfe do_syscall_64+0x9a/0xfd
 entry_SYSCALL_64_after_hwframe+0x4b/0x53 The details of command execution process are as follows. In the
 above resource tree, "System RAM" is a descendant of "CXL Window 0" instead of a top level resource. So,
 region_intersects() will report no System RAM resources in the CXL memory region incorrectly, because it
 only checks the top level resources. Consequently, devmem_is_allowed() will return 1 (allow access via
 /dev/mem) for CXL memory region incorrectly. Fortunately, ioremap() doesn't allow to map System RAM and
 reject the access. So, region_intersects() needs to be fixed to work correctly with the resource tree with
 "System RAM" not at top level as above. To fix it, if we found a unmatched resource in the top level, we
 will continue to search matched resources in its descendant resources. So, we will not miss any matched
 resources in resource tree anymore. In the new implementation, an example resource tree |-------------
 "CXL Window 0" ------------| |-- "System RAM" --| will behave similar as the following fake resource tree
 for region_intersects(, IORESOURCE_SYSTEM_RAM, ), |-- "System RAM" --||-- "CXL Window 0a" --| Where "CXL
 Window 0a" is part of the original "CXL Window 0" that isn't covered by "System RAM". (CVE-2024-49878)

Solution

Update the sys-kernel/lakitu-kernel-6_1 library and its related packages to version 18613.75.4 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-117.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 471675

Version: Revision 1.2

Type: Local

Published: 10/3/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6

Percentile: 97.19

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2024-49878

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/21/2024

Reference Information

CVE: CVE-2024-49878