cbcvebase.
CVE-2024-35877
published 2024-05-19

CVE-2024-35877: In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: fix VM_PAT handling in COW mappings PAT handling won't do the right thing in…

PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.25%
16.6th percentile
In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: fix VM_PAT handling in COW mappings PAT handling won't do the right thing in COW mappings: the first PTE (or, in fact, all PTEs) can be replaced during write faults to point at anon folios. Reliably recovering the correct PFN and cachemode using follow_phys() from PTEs will not work in COW mappings. Using follow_phys(), we might just get the address+protection of the anon folio (which is very wrong), or fail on swap/nonswap entries, failing follow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and track_pfn_copy(), not properly calling free_pfn_range(). In free_pfn_range(), we either wouldn't call memtype_free() or would call it with the wrong range, possibly leaking memory. To fix that, let's update follow_phys() to refuse returning anon folios, and fallback to using the stored PFN inside vma->vm_pgoff for COW mappings if we run into that. We will now properly handle untrack_pfn() with COW mappings, where we don't need the cachemode. We'll have to fail fork()->track_pfn_copy() if the first page was replaced by an anon folio, though: we'd have to store the cachemode in the VMA to make this work, likely growing the VMA size. For now, lets keep it simple and let track_pfn_copy() just fail in that case: it would have failed in the past with swap/nonswap entries already, and it would have done the wrong thing with anon folios. Simple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn(): #include #include #include #include int main(void) { struct io_uring_params p = {}; int ring_fd; size_t size; char *map; ring_fd = io_uring_setup(1, &p); if (ring_fd On a system with 16 GiB RAM and swap configured: # ./iouring & # memhog 16G # killall iouring [ 301.552930] ------------[ cut here ]------------ [ 301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100 [ 301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_

Affected

28 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.85-1 (bookworm)linux 6.1.85-1 (bookworm)
linuxlinux
linuxlinux>= 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 < f18681daaec9665a15c5e7e0f591aad5d0ac622bf18681daaec9665a15c5e7e0f591aad5d0ac622b
linuxlinux>= 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 < 09e6bb53217bf388a0d2fd7fb21e74ab9dffc17309e6bb53217bf388a0d2fd7fb21e74ab9dffc173
linuxlinux>= 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 < c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4
linuxlinux>= 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 < 7cfee26d1950250b14c5cb0a37b142f3fcc6396a7cfee26d1950250b14c5cb0a37b142f3fcc6396a
linuxlinux>= 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 < 97e93367e82752e475a33839a80b33bdbef1209f97e93367e82752e475a33839a80b33bdbef1209f
linuxlinux>= 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 < 51b7841f3fe84606ec0bd8da859d22e05e5419ec51b7841f3fe84606ec0bd8da859d22e05e5419ec
linuxlinux>= 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 < 1341e4b32e1fb1b0acd002ccd56f07bd32f2abc61341e4b32e1fb1b0acd002ccd56f07bd32f2abc6
linuxlinux>= 5899329b19100c0b82dc78e9b21ed8b920c9ffb3 < 04c35ab3bdae7fefbd7c7a7355f29fa03a03522104c35ab3bdae7fefbd7c7a7355f29fa03a035221
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.216-15.10.216-1
linuxlinux_kernel>= 0 < 6.1.85-16.1.85-1
linuxlinux_kernel>= 0 < 6.8.9-16.8.9-1
linuxlinux_kernel>= 0 < 6.8.9-16.8.9-1
linuxlinux_kernel>= 0 < 5.4.0-189.2095.4.0-189.209
linuxlinux_kernel>= 0 < 5.15.0-116.1265.15.0-116.126
linuxlinux_kernel>= 0 < 6.8.0-38.386.8.0-38.38
linuxlinux_kernel>= 0 < 4.4.0-261.2954.4.0-261.295
linuxlinux_kernel>= 0 < 4.15.0-231.2434.15.0-231.243
linuxlinux_kernel>= 2.6.29 < 4.19.3124.19.312
linuxlinux_kernel>= 4.20 < 5.4.2745.4.274
linuxlinux_kernel>= 5.11 < 5.15.1555.15.155
linuxlinux_kernel>= 5.16 < 6.1.856.1.85

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.