Description
In the Linux kernel, the following vulnerability has been resolved: uacce: implement mremap in uacce_vm_ops to return -EPERM The current uacce_vm_ops does not support the mremap operation of vm_operations_struct. Implement .mremap to return -EPERM to remind users. The reason we need to explicitly disable mremap is that when the driver does not implement .mremap, it uses the default mremap method. This could lead to a risk scenario: An application might first mmap address p1, then mremap to p2, followed by munmap(p1), and finally munmap(p2). Since the default mremap copies the original vma's vm_private_data (i.e., q) to the new vma, both munmap operations would trigger vma_close, causing q->qfr to be freed twice(qfr will be set to null here, so repeated release is ok).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
015d239ac0142ad0e26567fd890ef8d171f13709 to < 78d99f062d42e3af2ca46bde1a8e46e0dfd372e3affected015d239ac0142ad0e26567fd890ef8d171f13709 to < ebfa85658a39b49ec3901ceea7535b73aa0429e6affected015d239ac0142ad0e26567fd890ef8d171f13709 to < 75b29bdc935ff93b8e8bf6f6b4d8a4810b26e06faffected015d239ac0142ad0e26567fd890ef8d171f13709 to < 4c042bc71474dbe417c268f4bfb8ec196f802f07affected015d239ac0142ad0e26567fd890ef8d171f13709 to < a407ddd61b3e6afc5ccfcd1478797171cf5686eeaffected015d239ac0142ad0e26567fd890ef8d171f13709 to < ba29b59d124e725e0377f09b2044909c91d657a1affected015d239ac0142ad0e26567fd890ef8d171f13709 to < 02695347be532b628f22488300d40c4eba48b9b7affected
Linux Linux
Default version status: affected
5.7affected0 to < 5.7unaffected5.10.249 to ≤ 5.10.*unaffected5.15.199 to ≤ 5.15.*unaffected6.1.162 to ≤ 6.1.*unaffected6.6.122 to ≤ 6.6.*unaffected6.12.68 to ≤ 6.12.*unaffected6.18.8 to ≤ 6.18.*unaffected6.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/78d99f062d42e3af2ca46bde1a8e46e0dfd372e3 ↗
- https://git.kernel.org/stable/c/ebfa85658a39b49ec3901ceea7535b73aa0429e6 ↗
- https://git.kernel.org/stable/c/75b29bdc935ff93b8e8bf6f6b4d8a4810b26e06f ↗
- https://git.kernel.org/stable/c/4c042bc71474dbe417c268f4bfb8ec196f802f07 ↗
- https://git.kernel.org/stable/c/a407ddd61b3e6afc5ccfcd1478797171cf5686ee ↗
- https://git.kernel.org/stable/c/ba29b59d124e725e0377f09b2044909c91d657a1 ↗
- https://git.kernel.org/stable/c/02695347be532b628f22488300d40c4eba48b9b7 ↗