cbcvebase.
CVE-2024-53096
published 2024-11-25

CVE-2024-53096: In the Linux kernel, the following vulnerability has been resolved: mm: resolve faulty mmap_region() error path behaviour The mmap_region() function is…

PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.34%
26.5th percentile
In the Linux kernel, the following vulnerability has been resolved: mm: resolve faulty mmap_region() error path behaviour The mmap_region() function is somewhat terrifying, with spaghetti-like control flow and numerous means by which issues can arise and incomplete state, memory leaks and other unpleasantness can occur. A large amount of the complexity arises from trying to handle errors late in the process of mapping a VMA, which forms the basis of recently observed issues with resource leaks and observable inconsistent state. Taking advantage of previous patches in this series we move a number of checks earlier in the code, simplifying things by moving the core of the logic into a static internal function __mmap_region(). Doing this allows us to perform a number of checks up front before we do any real work, and allows us to unwind the writable unmap check unconditionally as required and to perform a CONFIG_DEBUG_VM_MAPLE_TREE validation unconditionally also. We move a number of things here: 1. We preallocate memory for the iterator before we call the file-backed memory hook, allowing us to exit early and avoid having to perform complicated and error-prone close/free logic. We carefully free iterator state on both success and error paths. 2. The enclosing mmap_region() function handles the mapping_map_writable() logic early. Previously the logic had the mapping_map_writable() at the point of mapping a newly allocated file-backed VMA, and a matching mapping_unmap_writable() on success and error paths. We now do this unconditionally if this is a file-backed, shared writable mapping. If a driver changes the flags to eliminate VM_MAYWRITE, however doing so does not invalidate the seal check we just performed, and we in any case always decrement the counter in the wrapper. We perform a debug assert to ensure a driver does not attempt to do the opposite. 3. We also move arch_validate_flags() up into the mmap_region() function. This is only relevant on arm64 a

Affected

29 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.119-1 (bookworm)linux 6.1.119-1 (bookworm)
debianlinux-6.1< linux 6.1.119-1 (bookworm)linux 6.1.119-1 (bookworm)
linuxlinux——
linuxlinux——
linuxlinux——
linuxlinux>= 43bed0a13a5cdbb314d14f28c2bf2c60eb4e6e1e < 44f48eb9a6051826227bbd375446064fb2a43c6c44f48eb9a6051826227bbd375446064fb2a43c6c
linuxlinux>= 5.10.150 < 5.10.2315.10.231
linuxlinux>= 5.15.75 < 5.15.1745.15.174
linuxlinux>= 5.19.17 < 5.205.20
linuxlinux>= 6.0.3 < 6.16.1
linuxlinux>= a3c08c021778dad30f69895e378843e9f423d734 < 43323a4e5b3f8ccc08e2f835abfdc7ee9da8f6ed43323a4e5b3f8ccc08e2f835abfdc7ee9da8f6ed
linuxlinux>= deb0f6562884b5b4beb883d73e66a7d3a1b96d99 < 52c81fd0f5a8bf8032687b94ccf00d13b44cc5c852c81fd0f5a8bf8032687b94ccf00d13b44cc5c8
linuxlinux>= deb0f6562884b5b4beb883d73e66a7d3a1b96d99 < bdc136e2b05fabcd780fe5f165d154eb779dfcb0bdc136e2b05fabcd780fe5f165d154eb779dfcb0
linuxlinux>= deb0f6562884b5b4beb883d73e66a7d3a1b96d99 < 5de195060b2e251a835f622759550e62021676415de195060b2e251a835f622759550e6202167641
linuxlinux_kernel——
linuxlinux_kernel——
linuxlinux_kernel>= 0 < 5.10.234-15.10.234-1
linuxlinux_kernel>= 0 < 6.1.119-16.1.119-1
linuxlinux_kernel>= 0 < 6.12.3-16.12.3-1
linuxlinux_kernel>= 0 < 6.12.3-16.12.3-1
linuxlinux_kernel>= 0 < 5.15.0-135.1465.15.0-135.146
linuxlinux_kernel>= 0 < 6.8.0-58.606.8.0-58.60
linuxlinux_kernel>= 5.10.150 < 5.10.2315.10.231
linuxlinux_kernel>= 5.15.75 < 5.15.1745.15.174
linuxlinux_kernel>= 6.0.3 < 6.1.1196.1.119

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.