CVE-2024-42233

published 2024-08-07

CVE-2024-42233: In the Linux kernel, the following vulnerability has been resolved: filemap: replace pte_offset_map() with pte_offset_map_nolock() The vmf->ptl in…

Priority P4 9 low 3.3 CVSS 3.1

AV L AC L PR L UI N S U C N I L A N

In the Linux kernel, the following vulnerability has been resolved:

filemap: replace pte_offset_map() with pte_offset_map_nolock()

The vmf->ptl in filemap_fault_recheck_pte_none() is still set from
handle_pte_fault(). But at the same time, we did a pte_unmap(vmf->pte).
After a pte_unmap(vmf->pte) unmap and rcu_read_unlock(), the page table
may be racily changed and vmf->ptl maybe fails to protect the actual page
table. Fix this by replacing pte_offset_map() with
pte_offset_map_nolock().

As David said, the PTL pointer might be stale so if we continue to use
it infilemap_fault_recheck_pte_none(), it might trigger UAF. Also, if
the PTL fails, the issue fixed by commit 58f327f2ce80 ("filemap: avoid
unnecessary major faults in filemap_fault()") might reappear.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.9.10-1 (forky)	linux 6.9.10-1 (forky)
linux	linux	—	—
linux	linux	>= 58f327f2ce80f9c7b4a70e9cf017ae8810d44a20 < 6a6c2aec1a89506595801b4cf7e8eef035f33748	6a6c2aec1a89506595801b4cf7e8eef035f33748
linux	linux	>= 58f327f2ce80f9c7b4a70e9cf017ae8810d44a20 < 24be02a42181f0707be0498045c4c4b13273b16d	24be02a42181f0707be0498045c4c4b13273b16d
linux	linux_kernel	>= 0 < 6.9.10-1	6.9.10-1
linux	linux_kernel	>= 0 < 6.9.10-1	6.9.10-1
linux	linux_kernel	>= 6.9 < 6.9.10	6.9.10

CVSS provenance

nvd v3.1 3.3 LOW CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

osv 3.3 LOW

vendor_debian 3.3 LOW

vendor_redhat 3.3 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-99