Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap bnxt_re_mmap() rejects VM_WRITE for the DBR_PAGE and TOGGLE_PAGE mmap flags, but a read-only mapping can still retain VM_MAYWRITE. nd later be upgraded with mprotect(PROT_WRITE). This can bypass the write check that only runs at mmap time. Clear VM_MAYWRITE before vm_insert_page() in the shared DBR/toggle-page branch, matching the existing policy that userspace writes are not expected for these pages.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ea222485788208cd79bad42d25aae9232b33a934 to < 5361fb1e5bc246f9a2c0721543f72c8dac200769affectedea222485788208cd79bad42d25aae9232b33a934 to < 13e7861809ef9e7e720ff5f0af1d4293a6d0a9b4affectedea222485788208cd79bad42d25aae9232b33a934 to < 0afbfe019c881483337d9f8304e678af05ebe7ccaffectedea222485788208cd79bad42d25aae9232b33a934 to < 518df61b9b0a5b288dfa72c87246045329c18b8caffectedea222485788208cd79bad42d25aae9232b33a934 to < 9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16affected
Linux Linux
Default version status: affected
6.6affected0 to < 6.6unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/5361fb1e5bc246f9a2c0721543f72c8dac200769 ↗
- https://git.kernel.org/stable/c/13e7861809ef9e7e720ff5f0af1d4293a6d0a9b4 ↗
- https://git.kernel.org/stable/c/0afbfe019c881483337d9f8304e678af05ebe7cc ↗
- https://git.kernel.org/stable/c/518df61b9b0a5b288dfa72c87246045329c18b8c ↗
- https://git.kernel.org/stable/c/9b66c9af7172ffcf727214fa0ebe9a5e1ed6eb16 ↗