{"id":"DEBIAN-CVE-2024-41065","details":"In the Linux kernel, the following vulnerability has been resolved:  powerpc/pseries: Whitelist dtl slub object for copying to userspace  Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-* results in a BUG() when the config CONFIG_HARDENED_USERCOPY is enabled as shown below.      kernel BUG at mm/usercopy.c:102!     Oops: Exception in kernel mode, sig: 5 [#1]     LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries     Modules linked in: xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc     scsi_transport_fc ibmveth pseries_wdt dm_multipath dm_mirror dm_region_hash dm_log dm_mod fuse     CPU: 27 PID: 1815 Comm: python3 Not tainted 6.10.0-rc3 #85     Hardware name: IBM,9040-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_042) hv:phyp pSeries     NIP:  c0000000005d23d4 LR: c0000000005d23d0 CTR: 00000000006ee6f8     REGS: c000000120c078c0 TRAP: 0700   Not tainted  (6.10.0-rc3)     MSR:  8000000000029033 \u003cSF,EE,ME,IR,DR,RI,LE\u003e  CR: 2828220f  XER: 0000000e     CFAR: c0000000001fdc80 IRQMASK: 0     [ ... GPRs omitted ... ]     NIP [c0000000005d23d4] usercopy_abort+0x78/0xb0     LR [c0000000005d23d0] usercopy_abort+0x74/0xb0     Call Trace:      usercopy_abort+0x74/0xb0 (unreliable)      __check_heap_object+0xf8/0x120      check_heap_object+0x218/0x240      __check_object_size+0x84/0x1a4      dtl_file_read+0x17c/0x2c4      full_proxy_read+0x8c/0x110      vfs_read+0xdc/0x3a0      ksys_read+0x84/0x144      system_call_exception+0x124/0x330      system_call_vectored_common+0x15c/0x2ec     --- interrupt: 3000 at 0x7fff81f3ab34  Commit 6d07d1cd300f (\"usercopy: Restrict non-usercopy caches to size 0\") requires that only whitelisted areas in slab/slub objects can be copied to userspace when usercopy hardening is enabled using CONFIG_HARDENED_USERCOPY. Dtl contains hypervisor dispatch events which are expected to be read by privileged users. Hence mark this safe for user access. Specify useroffset=0 and usersize=DISPATCH_LOG_BYTES to whitelist the entire object.","modified":"2026-09-15T09:02:57.667390461Z","published":"2024-07-29T15:15:14.410Z","upstream":["CVE-2024-41065"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-41065"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.106-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-41065.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.11-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-41065.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9.11-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-41065.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}