CVE-2024-41032: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability has been identified in the Linux kernel's memory management subsystem, specifically in the vmalloc functionality (CVE-2024-41032). The issue was discovered in July 2024 and affects systems where cpu_possible_mask has gaps between set CPUs, particularly on SPARC architectures. The vulnerability stems from the addr_to_vb_xa() hash function incorrectly accessing non-possible and non-setup CPU areas using the per_cpu() macro (Kernel Git).

The technical issue lies in the vmalloc subsystem where a per-cpu vmap_block_queue is used as a hash table, incorrectly assuming the cpu_possible_mask has no gaps. The addr_to_vb_xa() hash function can return an index that accesses non-possible and non-setup CPU areas through the per_cpu() macro, which results in an oops on SPARC systems. The vulnerability was introduced by commit 062eacf57ad9 'mm: vmalloc: remove a global vmap_blocks xarray' (Kernel Git).

When exploited, this vulnerability results in a system oops (kernel panic) on affected SPARC architectures, leading to a denial of service condition. The issue specifically impacts systems where the CPU possible mask contains gaps between set CPUs (Kernel Git).

The vulnerability requires local access to the system and specifically affects SPARC architectures with specific CPU configurations. There are no known reports of this vulnerability being exploited in the wild (NVD).

The issue has been fixed in various Linux kernel versions. Ubuntu has released patches for multiple kernel versions including linux-gke (6.8.0-1013.17), linux-aws (6.8.0-1018.20), and others. The fix involves adjusting the index to the next possible CPU when the hash-index is not in cpu_possible_mask (Ubuntu Security).