{"id":"DEBIAN-CVE-2024-50099","details":"In the Linux kernel, the following vulnerability has been resolved:  arm64: probes: Remove broken LDR (literal) uprobe support  The simulate_ldr_literal() and simulate_ldrsw_literal() functions are unsafe to use for uprobes. Both functions were originally written for use with kprobes, and access memory with plain C accesses. When uprobes was added, these were reused unmodified even though they cannot safely access user memory.  There are three key problems:  1) The plain C accesses do not have corresponding extable entries, and    thus if they encounter a fault the kernel will treat these as    unintentional accesses to user memory, resulting in a BUG() which    will kill the kernel thread, and likely lead to further issues (e.g.    lockup or panic()).  2) The plain C accesses are subject to HW PAN and SW PAN, and so when    either is in use, any attempt to simulate an access to user memory    will fault. Thus neither simulate_ldr_literal() nor    simulate_ldrsw_literal() can do anything useful when simulating a    user instruction on any system with HW PAN or SW PAN.  3) The plain C accesses are privileged, as they run in kernel context,    and in practice can access a small range of kernel virtual addresses.    The instructions they simulate have a range of +/-1MiB, and since the    simulated instructions must itself be a user instructions in the    TTBR0 address range, these can address the final 1MiB of the TTBR1    acddress range by wrapping downwards from an address in the first    1MiB of the TTBR0 address range.     In contemporary kernels the last 8MiB of TTBR1 address range is    reserved, and accesses to this will always fault, meaning this is no    worse than (1).     Historically, it was theoretically possible for the linear map or    vmemmap to spill into the final 8MiB of the TTBR1 address range, but    in practice this is extremely unlikely to occur as this would    require either:     * Having enough physical memory to fill the entire linear map all the      way to the final 1MiB of the TTBR1 address range.     * Getting unlucky with KASLR randomization of the linear map such      that the populated region happens to overlap with the last 1MiB of      the TTBR address range.     ... and in either case if we were to spill into the final page there    would be larger problems as the final page would alias with error    pointers.  Practically speaking, (1) and (2) are the big issues. Given there have been no reports of problems since the broken code was introduced, it appears that no-one is relying on probing these instructions with uprobes.  Avoid these issues by not allowing uprobes on LDR (literal) and LDRSW (literal), limiting the use of simulate_ldr_literal() and simulate_ldrsw_literal() to kprobes. Attempts to place uprobes on LDR (literal) and LDRSW (literal) will be rejected as arm_probe_decode_insn() will return INSN_REJECTED. In future we can consider introducing working uprobes support for these instructions, but this will require more significant work.","modified":"2026-09-15T09:03:15.380841893Z","published":"2024-11-05T18:15:13.690Z","upstream":["CVE-2024-50099"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-50099"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.115-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-50099.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-50099.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-50099.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}