CVE-2024-56678

Summary

CVE-2024-56678 is a vulnerability affecting the Linux kernel's powerpc/mm/fault subsystem. The issue lies in the use of the copy_from_kernel_nofault() function when reading from /proc/kcore, which can result in page faults caused by unmapped kfence objects. These page faults can be triggered by attempting to read large amounts of data from /proc/kcore, such as with the 'dd' command. The vulnerability can lead to invalid reads and use-after-free read issues, as demonstrated by the provided example. To mitigate these issues, the kernel now searches exception tables for the nip that generated the fault and lets the fixup table handler handle the page fault.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.