CVE-2024-35872: mm/secretmem: fix GUP-fast succeeding on secretmem folios
In the Linux kernel, the following vulnerability has been resolved:
mm/secretmem: fix GUP-fast succeeding on secretmem folios
folioissecretmem() currently relies on secretmem folios being LRU folios, to save some cycles.
However, folios might reside in a folio batch without the LRU flag set, or temporarily have their LRU flag cleared. Consequently, the LRU flag is unreliable for this purpose.
In particular, this is the case when secretmemfault() allocates a fresh page and calls filemapaddfolio()->folioaddlru(). The folio might be added to the per-cpu folio batch and won't get the LRU flag set until the batch was drained using e.g., lruadddrain().
Consequently, folioissecretmem() might not detect secretmem folios and GUP-fast can succeed in grabbing a secretmem folio, crashing the kernel when we would later try reading/writing to the folio, because the folio has been unmapped from the directmap.
Fix it by removing that unreliable check.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
mm/secretmem: fix GUP-fast succeeding on secretmem folios
The Linux kernel CVE team has assigned CVE-2024-35872 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051941-CVE-2024-35872-4632@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.154 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.85 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.26 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.5 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Configuration
Fix the kernel vulnerability by removing the unreliable LRU-based check that folio_is_secretmem() uses for detecting secretmem folios, so that GUP-fast cannot succeed on secretmem folios (which can otherwise lead to a kernel crash when the folio is later accessed after being unmapped from the directmap).
Linux kernel (mm/secretmem) folio_is_secretmem() LRU-based check = removed - Compensating control
Mitigation: restrict exposure/usage paths that can trigger GUP-fast access to secretmem mappings until the kernel fix for mm/secretmem is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35872?
CVE-2024-35872 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-35872?
To fix CVE-2024-35872, update the kernel to the recommended versions such as 5.15.154, 6.1.85, 6.6.26, 6.8.5, or 6.9 for Red Hat and specific versions for Debian.
Which Linux kernel versions are affected by CVE-2024-35872?
CVE-2024-35872 affects multiple Linux kernel versions prior to 5.15.154, 6.1.85, and includes certain versions of 6.12.x.
Is CVE-2024-35872 a remote or local vulnerability?
CVE-2024-35872 is a local vulnerability, requiring local access to exploit.
What are the potential impacts of CVE-2024-35872?
The potential impacts of CVE-2024-35872 include unauthorized access to sensitive memory segments in the Linux kernel.