title: x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer()
description: In the Linux kernel, the following vulnerability has been resolved:
x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer()
The code calling ima_free_kexec_buffer() runs long after the memblock
allocator has already been torn down, potentially resulting in a use
after free in memblock_isolate_range().
With KASAN or KFENCE, this use after free will result in a BUG
from the idle task, and a subsequent kernel panic.
Switch ima_free_kexec_buffer() over to memblock_free_late() to avoid
that bug.
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: fee3ff99bc67, lessThan: eef16bfdb212, status: affected, versionType: git
version: fee3ff99bc67, lessThan: d2dfbc0e3b7a, status: affected, versionType: git
version: fee3ff99bc67, lessThan: 34cf99c250d5, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 5.13, status: affected
version: 0, lessThan: 5.13, status: unaffected, versionType: custom
version: 6.1.56, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.5.6, lessThanOrEqual: 6.5.*, status: unaffected, versionType: custom
version: 6.6, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
