CVE-2017-1000405: Race Condition
A flaw was found in the patches used to fix the 'dirtycow' vulnerability CVE-2016-5195). The touchpmd() function can be accessed by getuserpages(). In this case, the pmd will become dirty without going through the Copy On Write cycle.
In the simplest example, a large page that is read-only can be modified, including page 0 of a processes virtual address space.
Upstream patch: https://github.com/torvalds/linux/commit/a8f97366452ed491d13cf1e44241bc0b5740b1f0
Vulnerability announcement: http://www.openwall.com/lists/oss-security/2017/11/30/1
Other sources
The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmdmkdirty() in the touchpmd() function inside the THP implementation. touchpmd() can be reached by getuserpages(). In such case, the pmd will become dirty. This scenario breaks the new canfollowwritepmd()'s logic - pmd can become dirty without going through a COW cycle. This bug is not as severe as the original "Dirty cow" because an ext4 file (or any other regular file) cannot be mapped using THP. Nevertheless, it does allow us to overwrite read-only huge pages. For example, the zero huge page and sealed shmem files can be overwritten (since their mapping can be populated using THP). Note that after the first write page-fault to the zero page, it will be replaced with a new fresh (and zeroed) thp.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000405?
CVE-2017-1000405 has been classified as a moderate severity vulnerability due to its potential impact on Linux Kernel security.
How do I fix CVE-2017-1000405?
To fix CVE-2017-1000405, update your Linux Kernel to a version that includes the security patches addressing this vulnerability.
What types of systems are affected by CVE-2017-1000405?
CVE-2017-1000405 affects various versions of the Linux Kernel, specifically those between 3.2.87 and 4.14.4.
Is CVE-2017-1000405 related to CVE-2016-5195?
Yes, CVE-2017-1000405 is a flaw found in the patches that were implemented to fix the earlier CVE-2016-5195 'dirtycow' vulnerability.
What is the potential impact of CVE-2017-1000405?
The potential impact of CVE-2017-1000405 includes unauthorized access to system resources and possible data breaches.