CVE-2024-46852: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-46852 is a vulnerability in the Linux kernel's DMA-BUF heap implementation, specifically affecting the CMA heap fault handler. The vulnerability was discovered and reported by Xingyu Jin, with the fix being implemented in September 2024. The issue affects Linux kernel versions from 5.11 up to versions before 6.1.111, 6.2 through 6.6.52, 6.7 through 6.10.11, and various 6.11 release candidates (NVD).

The vulnerability stems from an off-by-one error in the CMA heap fault handler. Prior to the addition of VM_DONTEXPAND in commit 1c1914d6e8c6, it was possible to obtain a mapping larger than the buffer size via mremap and bypass the overflow check in dma_buf_mmap_internal. When attempting to fault past the end of the buffer, the CMA heap fault handler incorrectly checked the fault offset against the buffer size, leading to potential memory access beyond the intended boundary. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD, Kernel Patch).

The vulnerability could allow an attacker to read beyond the end of the pages array and insert an arbitrary page in the mapping, potentially leading to unauthorized memory access and system compromise. The high CVSS score indicates that successful exploitation could result in complete compromise of confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability has been fixed by correcting the boundary check in the CMA heap fault handler, changing the condition from 'if (vmf->pgoff > buffer->pagecount)' to 'if (vmf->pgoff >= buffer->pagecount)'. The fix has been implemented across multiple kernel versions through various stable branch commits (Kernel Patch).