Description
In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths Any codepath that zaps page table entries must invoke MMU notifiers to ensure that secondary MMUs (like KVM) don't keep accessing pages which aren't mapped anymore. Secondary MMUs don't hold their own references to pages that are mirrored over, so failing to notify them can lead to page use-after-free. I'm marking this as addressing an issue introduced in commit f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages"), but most of the security impact of this only came in commit 27e1f8273113 ("khugepaged: enable collapse pmd for pte-mapped THP"), which actually omitted flushes for the removal of present PTEs, not just for the removal of empty page tables.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
f3f0e1d2150b2b99da2cbdfaad000089efe9bf30 to < 275c626c131cfe141beeb6c575e31fa53d32da19affectedf3f0e1d2150b2b99da2cbdfaad000089efe9bf30 to < c23105673228c349739e958fa33955ed8faddcafaffectedf3f0e1d2150b2b99da2cbdfaad000089efe9bf30 to < ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3affectedf3f0e1d2150b2b99da2cbdfaad000089efe9bf30 to < 5ffc2a75534d9d74d49760f983f8eb675fa63d69affectedf3f0e1d2150b2b99da2cbdfaad000089efe9bf30 to < 7f445ca2e0e59c7971d0b7b853465e50844ab596affectedf3f0e1d2150b2b99da2cbdfaad000089efe9bf30 to < 1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3affectedf3f0e1d2150b2b99da2cbdfaad000089efe9bf30 to < 5450535901d89a5dcca5fbbc59a24fe89caeb465affectedf3f0e1d2150b2b99da2cbdfaad000089efe9bf30 to < f268f6cf875f3220afc77bdd0bf1bb136eb54db9affected
Linux Linux
Default version status: affected
4.8affected0 to < 4.8unaffected4.9.337 to ≤ 4.9.*unaffected4.14.303 to ≤ 4.14.*unaffected4.19.270 to ≤ 4.19.*unaffected5.4.227 to ≤ 5.4.*unaffected5.10.159 to ≤ 5.10.*unaffected5.15.83 to ≤ 5.15.*unaffected6.0.13 to ≤ 6.0.*unaffected6.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/275c626c131cfe141beeb6c575e31fa53d32da19 ↗
- https://git.kernel.org/stable/c/c23105673228c349739e958fa33955ed8faddcaf ↗
- https://git.kernel.org/stable/c/ff2a1a6f869650aec99e9d070b5ab625bfbc5bc3 ↗
- https://git.kernel.org/stable/c/5ffc2a75534d9d74d49760f983f8eb675fa63d69 ↗
- https://git.kernel.org/stable/c/7f445ca2e0e59c7971d0b7b853465e50844ab596 ↗
- https://git.kernel.org/stable/c/1a3f8c6cd29d9078cc81b29d39d0e9ae1d6a03c3 ↗
- https://git.kernel.org/stable/c/5450535901d89a5dcca5fbbc59a24fe89caeb465 ↗
- https://git.kernel.org/stable/c/f268f6cf875f3220afc77bdd0bf1bb136eb54db9 ↗