{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-43832",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-43832"
  ],
  "published": "2024-08-17T09:22:42Z",
  "summary": "s390/uv: Don't call folio_wait_writeback() without a folio reference",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/uv: Don't call folio_wait_writeback() without a folio reference\n\nfolio_wait_writeback() requires that no spinlocks are held and that\na folio reference is held, as documented. After we dropped the PTL, the\nfolio could get freed concurrently. So grab a temporary reference.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.103",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-43832"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1a1eb2f3fc453dcd52726d13e863938561489cb7"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/8736604ef53359a718c246087cd21dcec232d2fb"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b21aba72aadd94bdac275deab021fc84d6c72b16"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3f29f6537f54d74e64bac0a390fb2e26da25800d"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The vulnerable code is reached through the s390 KVM protected-virtualization path \u2014 the `KVM_S390_PV_COMMAND`/`KVM_RUN` ioctls on /dev/kvm and the host's secure/non-secure storage-access fault handler running in the vCPU thread. No network input is involved, so local system access is required.\nAC:L - The attacker controls both sides of the race: it forces `rc == -EAGAIN` deterministically (start writeback on the file/shmem-backed guest page so `make_folio_secure()` returns -EAGAIN, or hold the folio lock) while a second thread `MADV_DONTNEED`s/munmaps that guest memory to free the folio in the window after the PTL and mmap_read_lock are dropped. The attempt is cheap and infinitely retryable.\nPR:L - Only an unprivileged local user with access to /dev/kvm (commonly mode 0666 or the `kvm` group on distros) is needed to create a VM, enable protected virtualization, and drive the unpack/secure-storage paths; no CAP_SYS_ADMIN or real root is required. A malicious guest reaching `handle_pv_uvc()` with a guest-controlled address is likewise not a privileged host actor.\nUI:N - The entire sequence is performed by the attacker's own threads via ioctls and memory-management syscalls on its own VM. No victim action of any kind is needed.\nS:U - The attacking process and the corrupted resources (host kernel MM metadata) live under the same security authority \u2014 this is a local host-kernel compromise, not an IOMMU or hypervisor-boundary escape granting control of a separate authority.\nC:H - This is a use-after-free on a folio whose `struct page` has been reallocated to an unrelated owner; the code reads that stale state and the resulting page-state corruption is leverageable for disclosure of memory belonging to other subsystems. Per UAF scoring guidance, confidentiality impact is High.\nI:H - `folio_wait_bit_common()` performs an atomic `set_bit(PG_waiters, &folio->flags)` write into a `struct page` that now describes someone else's allocation, corrupting core MM metadata for a page the attacker can influence the reuse of via heap/page grooming \u2014 a write primitive into kernel state, hence High.\nA:H - A stale `PG_writeback` bit in the reused page makes `folio_wait_bit()` sleep TASK_UNINTERRUPTIBLE with no waker, producing an unkillable task and hung-task panics, while a spurious `PG_waiters` trips `bad_page()` (\"BUG: Bad page state\") since `PAGE_FLAGS_CHECK_AT_PREP` covers the whole flags mask. Either outcome is a full kernel-level denial of service."
    }
  }
}