In the Linux kernel, the following vulnerability has been resolved:
nvdimm/btt: reject an arena whose nfree is below the lane count
The BTT info block's nfree field, the number of reserve free blocks, is
read from the medium without validation. btt_freelist_init() and
btt_rtt_init() size the per-lane freelist[] and rtt[] arrays by nfree,
but the I/O path indexes them by the lane from nd_region_acquire_lane(),
which is bounded by nd_region->num_lanes (ND_MAX_LANES), not by nfree.
A crafted or foreign arena whose nfree is below the lane count makes
freelist[lane]/rtt[lane] run past the allocation: an out-of-bounds write.
btt.rst documents the nlanes = min(nfree, num_cpus) invariant, which the
code does not currently honor: num_lanes is ND_MAX_LANES regardless of
nfree. Reject an arena whose nfree is below num_lanes at discovery,
before the per-lane arrays are allocated, enforcing that invariant.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - The OOB write is reached via local BTT block I/O after discover_arenas() accepts a crafted on-media info block (nd_pmem_probe → nd_btt_probe/nvdimm_namespace_attach_btt → btt_init, then btt_submit_bio → btt_read_pg/btt_write_pg). virtio-pmem, QEMU nvdimm, CXL/ACPI pmem, and ndctl namespaces are local device paths, not a network protocol parser.
AC:L - nfree is taken from the attacker-controlled BTT info block after only signature, checksum, and optional parent-UUID checks (a null UUID skips the UUID match). Setting nfree=1 below ND_MAX_LANES (256) and pinning I/O to CPU 1+ with sched_setaffinity makes rtt[lane]/freelist[lane] deterministically overrun the nfree-sized kmalloc buffers; no race is required.
PR:L - Neither nd_open() nor btt_submit_bio() has a capable() check. Disk-group or PMEM-service accounts can write a valid-checksum info block to /dev/pmem (typically 0660). nd_btt_probe() auto-detects BTT even on claim_class NONE, so boot or ordinary namespace probe attaches the arena; subsequent I/O from that unprivileged principal hits the OOB without init-namespace root.
UI:N - Once a crafted arena is discovered, device_add_disk() partition scanning issues bios into btt_read_pg() and writes rtt[lane] with no victim mount or file open. Further exploitation is attacker-driven I/O on the BTT gendisk they already can access.
S:U - The heap out-of-bounds access corrupts kmalloc objects in the same kernel that parsed the BTT arena. This is standard kernel memory corruption, not a KVM/Xen guest-to-host escape or IOMMU/DMA boundary bypass.
C:H - btt_read_pg() stores RTT_VALID|postmap into arena->rtt[lane] and btt_write_pg() reads/writes arena->freelist[lane] past the nfree-sized allocations. postmap comes from the attacker-crafted map, so adjacent slab objects are overwritten with attacker-influenced values that can be turned into an arbitrary-read primitive.
I:H - The same lane-indexed stores are kernel heap out-of-bounds writes: rtt[] (u32 with attacker-controlled postmap) and freelist[] (block/sub/seq/has_err). Combined with CPU-affinity control of the lane index (0..255), this is an OOB write exploitable for control-flow hijacking. btt_flog_write() also writes logoff+laneLOG_GRP_SIZE on media.
A:H - Indexing past the nfree-sized rtt and freelist kmalloc buffers oopses or panics on poisoned slab metadata or unmapped pages. Any kernel crash from this OOB write is High availability impact and is repeatable on every I/O using a lane >= nfree.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The OOB write is reached via local BTT block I/O after discover_arenas() accepts a crafted on-media info block (nd_pmem_probe → nd_btt_probe/nvdimm_namespace_attach_btt → btt_init, then btt_submit_bio → btt_read_pg/btt_write_pg). virtio-pmem, QEMU nvdimm, CXL/ACPI pmem, and ndctl namespaces are local device paths, not a network protocol parser.
AC:L - nfree is taken from the attacker-controlled BTT info block after only signature, checksum, and optional parent-UUID checks (a null UUID skips the UUID match). Setting nfree=1 below ND_MAX_LANES (256) and pinning I/O to CPU 1+ with sched_setaffinity makes rtt[lane]/freelist[lane] deterministically overrun the nfree-sized kmalloc buffers; no race is required.
PR:L - Neither nd_open() nor btt_submit_bio() has a capable() check. Disk-group or PMEM-service accounts can write a valid-checksum info block to /dev/pmem (typically 0660). nd_btt_probe() auto-detects BTT even on claim_class NONE, so boot or ordinary namespace probe attaches the arena; subsequent I/O from that unprivileged principal hits the OOB without init-namespace root.
UI:N - Once a crafted arena is discovered, device_add_disk() partition scanning issues bios into btt_read_pg() and writes rtt[lane] with no victim mount or file open. Further exploitation is attacker-driven I/O on the BTT gendisk they already can access.
S:U - The heap out-of-bounds access corrupts kmalloc objects in the same kernel that parsed the BTT arena. This is standard kernel memory corruption, not a KVM/Xen guest-to-host escape or IOMMU/DMA boundary bypass.
C:H - btt_read_pg() stores RTT_VALID|postmap into arena->rtt[lane] and btt_write_pg() reads/writes arena->freelist[lane] past the nfree-sized allocations. postmap comes from the attacker-crafted map, so adjacent slab objects are overwritten with attacker-influenced values that can be turned into an arbitrary-read primitive.
I:H - The same lane-indexed stores are kernel heap out-of-bounds writes: rtt[] (u32 with attacker-controlled postmap) and freelist[] (block/sub/seq/has_err). Combined with CPU-affinity control of the lane index (0..255), this is an OOB write exploitable for control-flow hijacking. btt_flog_write() also writes logoff+laneLOG_GRP_SIZE on media.
A:H - Indexing past the nfree-sized rtt and freelist kmalloc buffers oopses or panics on poisoned slab metadata or unmapped pages. Any kernel crash from this OOB write is High availability impact and is repeatable on every I/O using a lane >= nfree.
CVSS 3.1