Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2024-47676

mm/hugetlb.c: fix UAF of vma in hugetlb fault pathway

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb.c: fix UAF of vma in hugetlb fault pathway Syzbot reports a UAF in hugetlb_fault(). This happens because vmf_anon_prepare() could drop the per-VMA lock and allow the current VMA to be freed before hugetlb_vma_unlock_read() is called. We can fix this by using a modified version of vmf_anon_prepare() that doesn't release the VMA lock on failure, and then release it ourselves after hugetlb_vma_unlock_read().

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 9acad7ba3e25d11f4c96df1b7312ae89e6faca5c to < e897d184a8dd4a4e1f39c8c495598e4d9472776caffected
  • 9acad7ba3e25d11f4c96df1b7312ae89e6faca5c to < d59ebc99dee0a2687a26df94b901eb8216dbf876affected
  • 9acad7ba3e25d11f4c96df1b7312ae89e6faca5c to < 98b74bb4d7e96b4da5ef3126511febe55b76b807affected

Linux Linux

Default version status: affected

  • 6.9affected
  • 0 to < 6.9unaffected
  • 6.10.13 to ≤ 6.10.*unaffected
  • 6.11.2 to ≤ 6.11.*unaffected
  • 6.12 to ≤ *unaffected

References