CVE-2024-49878: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability was discovered in the Linux kernel's resource management system affecting CXL memory handling. The issue occurs when drivers/dax/kmem.c calls addmemorydriver_managed() during CXL memory onlining, which makes "System RAM (kmem)" a descendant of "CXL Window X" in the resource tree. This vulnerability has been assigned CVE-2024-49878 and affects Linux kernel versions from 5.1 through 6.11.3 (NVD).

The vulnerability stems from a flaw in the regionintersects() function, which incorrectly assumes all "System RAM" resources are at the top level of iomemresource. When CXL memory is onlined, the resource tree structure places System RAM as a descendant node, causing regionintersects() to fail to properly identify System RAM regions. This leads to incorrect permission checking in devmemis_allowed(), which erroneously allows access to CXL memory regions via /dev/mem. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

While the vulnerability allows incorrect permission checking for CXL memory regions, the actual impact is mitigated by ioremap() which prevents mapping of System RAM. However, the flaw results in incorrect error reporting (showing "Bad address" instead of "Operation not permitted") and represents a potential security issue in the kernel's memory access control mechanisms (Kernel Patch).

The issue has been fixed in the Linux kernel through a patch that modifies the region_intersects() function to properly handle System RAM resources that are not at the top level. The fix involves searching for matched resources in descendant nodes when an unmatched resource is found at the top level (Kernel Patch). Users should update to patched kernel versions: 5.10.227 or later, 5.15.168 or later, 6.1.113 or later, 6.6.55 or later, or 6.11.3 or later (NVD).