Description
In the Linux kernel, the following vulnerability has been resolved: mm: clear uffd-wp PTE/PMD state on mremap() When mremap()ing a memory region previously registered with userfaultfd as write-protected but without UFFD_FEATURE_EVENT_REMAP, an inconsistency in flag clearing leads to a mismatch between the vma flags (which have uffd-wp cleared) and the pte/pmd flags (which do not have uffd-wp cleared). This mismatch causes a subsequent mprotect(PROT_WRITE) to trigger a warning in page_table_check_pte_flags() due to setting the pte to writable while uffd-wp is still set. Fix this by always explicitly clearing the uffd-wp pte/pmd flags on any such mremap() so that the values are consistent with the existing clearing of VM_UFFD_WP. Be careful to clear the logical flag regardless of its physical form; a PTE bit, a swap PTE bit, or a PTE marker. Cover PTE, huge PMD and hugetlb paths.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
63b2d4174c4ad1f40b48d7138e71bcb564c1fe03 to < 96fed9f20481d07eba8a7fe93bc77abef178198caffected63b2d4174c4ad1f40b48d7138e71bcb564c1fe03 to < 8e2f6ba256dd1e590addc48e6e9577bf39c482f2affected63b2d4174c4ad1f40b48d7138e71bcb564c1fe03 to < 310ac886d68de661c3a334198d8604b722d7fdf8affected63b2d4174c4ad1f40b48d7138e71bcb564c1fe03 to < 0cef0bb836e3cfe00f08f9606c72abd72fe78ca3affected
Linux Linux
Default version status: affected
5.7affected0 to < 5.7unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.11 to ≤ 6.12.*unaffected6.13 to ≤ *unaffected