In the Linux kernel, the following vulnerability has been resolved:
comedi: Flush partial mappings in error case
If some remappfnrange() calls succeeded before one failed, we still have buffer pages mapped into the userspace page tables when we drop the buffer reference with comedibufmap_put(bm). The userspace mappings are only cleaned up later in the mmap error path.
Fix it by explicitly flushing all mappings in our VMA on the error path.
See commit 79a61cc3fc04 ("mm: avoid leaving partial pfn mappings around in error case").
[ { "deprecated": false, "id": "CVE-2024-53148-0c98d2a5", "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b07fb464eb69a752406e78e62ab3a60bfa7b00d", "target": { "file": "drivers/comedi/comedi_fops.c" }, "digest": { "line_hashes": [ "318714583001023237180562977059950715771", "41910344002654743492251779526215357144", "24819023155557742861827985887804521681", "122867299097648433787228414863095069760" ], "threshold": 0.9 }, "signature_version": "v1" }, { "deprecated": false, "id": "CVE-2024-53148-30a98634", "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57f048c2d205b85e34282a9b0b0ae177e84c2f44", "target": { "file": "drivers/staging/comedi/comedi_fops.c", "function": "comedi_mmap" }, "digest": { "length": 1717.0, "function_hash": "272854751469974783544600971091996790120" }, "signature_version": "v1" }, { "deprecated": false, "id": "CVE-2024-53148-382e8a82", "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16c507df509113c037cdc0ba642b9ab3389bd26c", "target": { "file": "drivers/comedi/comedi_fops.c", "function": "comedi_mmap" }, "digest": { "length": 1717.0, "function_hash": "272854751469974783544600971091996790120" }, "signature_version": "v1" }, { "deprecated": false, "id": "CVE-2024-53148-4a9e6af2", "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9322408d83accc8b96322bc7356593206288c56", "target": { "file": "drivers/staging/comedi/comedi_fops.c", "function": "comedi_mmap" }, "digest": { "length": 1717.0, "function_hash": "272854751469974783544600971091996790120" }, "signature_version": "v1" }, { "deprecated": false, "id": "CVE-2024-53148-5590bb20", "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@297f14fbb81895f4ccdb0ad25d196786d6461e00", "target": { "file": "drivers/comedi/comedi_fops.c" }, "digest": { "line_hashes": [ "318714583001023237180562977059950715771", "41910344002654743492251779526215357144", "24819023155557742861827985887804521681", "122867299097648433787228414863095069760" ], "threshold": 0.9 }, "signature_version": "v1" }, { "deprecated": false, "id": "CVE-2024-53148-733f2a55", "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6963a06ce5c61d3238751ada04ee1569663a828", "target": { "file": "drivers/comedi/comedi_fops.c" }, "digest": { "line_hashes": [ "318714583001023237180562977059950715771", "41910344002654743492251779526215357144", "24819023155557742861827985887804521681", "122867299097648433787228414863095069760" ], "threshold": 0.9 }, "signature_version": "v1" }, { "deprecated": false, "id": "CVE-2024-53148-7a39ca9d", "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b07fb464eb69a752406e78e62ab3a60bfa7b00d", "target": { "file": "drivers/comedi/comedi_fops.c", "function": "comedi_mmap" }, "digest": { "length": 1717.0, "function_hash": "272854751469974783544600971091996790120" }, "signature_version": "v1" }, { "deprecated": false, "id": "CVE-2024-53148-8b6f3934", "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce8f9fb651fac95dd41f69afe54d935420b945bd", "target": { "file": "drivers/comedi/comedi_fops.c", "function": "comedi_mmap" }, "digest": { "length": 1717.0, "function_hash": "272854751469974783544600971091996790120" }, "signature_version": "v1" }, { "deprecated": false, "id": "CVE-2024-53148-8e62fc63", "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9322408d83accc8b96322bc7356593206288c56", "target": { "file": "drivers/staging/comedi/comedi_fops.c" }, "digest": { "line_hashes": [ "318714583001023237180562977059950715771", "41910344002654743492251779526215357144", "24819023155557742861827985887804521681", "122867299097648433787228414863095069760" ], "threshold": 0.9 }, "signature_version": "v1" }, { "deprecated": false, "id": "CVE-2024-53148-963fbcf9", "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6963a06ce5c61d3238751ada04ee1569663a828", "target": { "file": "drivers/comedi/comedi_fops.c", "function": "comedi_mmap" }, "digest": { "length": 1717.0, "function_hash": "272854751469974783544600971091996790120" }, "signature_version": "v1" }, { "deprecated": false, "id": "CVE-2024-53148-9762a1e5", "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8797b7712de704dc231f9e821d8eb3b9aeb3a032", "target": { "file": "drivers/comedi/comedi_fops.c" }, "digest": { "line_hashes": [ "318714583001023237180562977059950715771", "41910344002654743492251779526215357144", "24819023155557742861827985887804521681", "122867299097648433787228414863095069760" ], "threshold": 0.9 }, "signature_version": "v1" }, { "deprecated": false, "id": "CVE-2024-53148-b07b2688", "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8797b7712de704dc231f9e821d8eb3b9aeb3a032", "target": { "file": "drivers/comedi/comedi_fops.c", "function": "comedi_mmap" }, "digest": { "length": 1717.0, "function_hash": "272854751469974783544600971091996790120" }, "signature_version": "v1" }, { "deprecated": false, "id": "CVE-2024-53148-b745f6ea", "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57f048c2d205b85e34282a9b0b0ae177e84c2f44", "target": { "file": "drivers/staging/comedi/comedi_fops.c" }, "digest": { "line_hashes": [ "318714583001023237180562977059950715771", "41910344002654743492251779526215357144", "24819023155557742861827985887804521681", "122867299097648433787228414863095069760" ], "threshold": 0.9 }, "signature_version": "v1" }, { "deprecated": false, "id": "CVE-2024-53148-c3bc4dd3", "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@297f14fbb81895f4ccdb0ad25d196786d6461e00", "target": { "file": "drivers/comedi/comedi_fops.c", "function": "comedi_mmap" }, "digest": { "length": 1717.0, "function_hash": "272854751469974783544600971091996790120" }, "signature_version": "v1" }, { "deprecated": false, "id": "CVE-2024-53148-df4c56a9", "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16c507df509113c037cdc0ba642b9ab3389bd26c", "target": { "file": "drivers/comedi/comedi_fops.c" }, "digest": { "line_hashes": [ "318714583001023237180562977059950715771", "41910344002654743492251779526215357144", "24819023155557742861827985887804521681", "122867299097648433787228414863095069760" ], "threshold": 0.9 }, "signature_version": "v1" }, { "deprecated": false, "id": "CVE-2024-53148-f47197cb", "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce8f9fb651fac95dd41f69afe54d935420b945bd", "target": { "file": "drivers/comedi/comedi_fops.c" }, "digest": { "line_hashes": [ "318714583001023237180562977059950715771", "41910344002654743492251779526215357144", "24819023155557742861827985887804521681", "122867299097648433787228414863095069760" ], "threshold": 0.9 }, "signature_version": "v1" } ]