CVE-2024-36943 - Vulnerability Details - OpenCVE

ReportizFlow

In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan make_uffd_wp_pte() was previously doing: pte = ptep_get(ptep); ptep_modify_prot_start(ptep); pte = pte_mkuffd_wp(pte); ptep_modify_prot_commit(ptep, pte); But if another thread accessed or dirtied the pte between the first 2 calls, this could lead to loss of that information. Since ptep_modify_prot_start() gets and clears atomically, the following is the correct pattern and prevents any possible race. Any access after the first call would see an invalid pte and cause a fault: pte = ptep_modify_prot_start(ptep); pte = pte_mkuffd_wp(pte); ptep_modify_prot_commit(ptep, pte);

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/74b3d66f91d9f539f99faad74d796fa9a389a015
https://git.kernel.org/stable/c/c70dce4982ce1718bf978a35f8e26160b82081f4
https://lore.kernel.org/linux-cve-announce/2024053038-CVE-2024-36943-de68@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-36943
https://www.cve.org/CVERecord?id=CVE-2024-36943

History

No history.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-30T15:35:42.119Z

Updated: 2024-12-19T09:02:54.527Z

Reserved: 2024-05-30T15:25:07.073Z

Link: CVE-2024-36943

Vulnrichment

Updated: 2024-08-02T03:43:50.375Z

NVD

Status : Awaiting Analysis

Published: 2024-05-30T16:15:17.307

Modified: 2024-11-21T09:22:52.417

Link: CVE-2024-36943

Redhat

Severity : Moderate

Publid Date: 2024-05-30T00:00:00Z

Links: CVE-2024-36943 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-36943", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-30T15:25:07.073Z", "datePublished": "2024-05-30T15:35:42.119Z", "dateUpdated": "2024-12-19T09:02:54.527Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T09:02:54.527Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan\n\nmake_uffd_wp_pte() was previously doing:\n\n pte = ptep_get(ptep);\n ptep_modify_prot_start(ptep);\n pte = pte_mkuffd_wp(pte);\n ptep_modify_prot_commit(ptep, pte);\n\nBut if another thread accessed or dirtied the pte between the first 2\ncalls, this could lead to loss of that information. Since\nptep_modify_prot_start() gets and clears atomically, the following is the\ncorrect pattern and prevents any possible race. Any access after the\nfirst call would see an invalid pte and cause a fault:\n\n pte = ptep_modify_prot_start(ptep);\n pte = pte_mkuffd_wp(pte);\n ptep_modify_prot_commit(ptep, pte);"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/proc/task_mmu.c"], "versions": [{"version": "52526ca7fdb905a768a93f8faa418e9b988fc34b", "lessThan": "74b3d66f91d9f539f99faad74d796fa9a389a015", "status": "affected", "versionType": "git"}, {"version": "52526ca7fdb905a768a93f8faa418e9b988fc34b", "lessThan": "c70dce4982ce1718bf978a35f8e26160b82081f4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/proc/task_mmu.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.10", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/74b3d66f91d9f539f99faad74d796fa9a389a015"}, {"url": "https://git.kernel.org/stable/c/c70dce4982ce1718bf978a35f8e26160b82081f4"}], "title": "fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan", "x_generator": {"engine": "bippy-5f407fcff5a0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-05T18:15:10.001170Z", "id": "CVE-2024-36943", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-05T18:17:48.241Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.375Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/74b3d66f91d9f539f99faad74d796fa9a389a015", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c70dce4982ce1718bf978a35f8e26160b82081f4", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/74b3d66f91d9f539f99faad74d796fa9a389a015", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c70dce4982ce1718bf978a35f8e26160b82081f4", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:50.375Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-36943", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-05T18:15:10.001170Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-05T18:15:18.500Z"}}], "cna": {"title": "fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "52526ca7fdb905a768a93f8faa418e9b988fc34b", "lessThan": "74b3d66f91d9f539f99faad74d796fa9a389a015", "versionType": "git"}, {"status": "affected", "version": "52526ca7fdb905a768a93f8faa418e9b988fc34b", "lessThan": "c70dce4982ce1718bf978a35f8e26160b82081f4", "versionType": "git"}], "programFiles": ["fs/proc/task_mmu.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.8.10", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/proc/task_mmu.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/74b3d66f91d9f539f99faad74d796fa9a389a015"}, {"url": "https://git.kernel.org/stable/c/c70dce4982ce1718bf978a35f8e26160b82081f4"}], "x_generator": {"engine": "bippy-5f407fcff5a0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan\n\nmake_uffd_wp_pte() was previously doing:\n\n pte = ptep_get(ptep);\n ptep_modify_prot_start(ptep);\n pte = pte_mkuffd_wp(pte);\n ptep_modify_prot_commit(ptep, pte);\n\nBut if another thread accessed or dirtied the pte between the first 2\ncalls, this could lead to loss of that information. Since\nptep_modify_prot_start() gets and clears atomically, the following is the\ncorrect pattern and prevents any possible race. Any access after the\nfirst call would see an invalid pte and cause a fault:\n\n pte = ptep_modify_prot_start(ptep);\n pte = pte_mkuffd_wp(pte);\n ptep_modify_prot_commit(ptep, pte);"}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-12-19T09:02:54.527Z"}}}, "cveMetadata": {"cveId": "CVE-2024-36943", "state": "PUBLISHED", "dateUpdated": "2024-12-19T09:02:54.527Z", "dateReserved": "2024-05-30T15:25:07.073Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-30T15:35:42.119Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan\n\nmake_uffd_wp_pte() was previously doing:\n\n pte = ptep_get(ptep);\n ptep_modify_prot_start(ptep);\n pte = pte_mkuffd_wp(pte);\n ptep_modify_prot_commit(ptep, pte);\n\nBut if another thread accessed or dirtied the pte between the first 2\ncalls, this could lead to loss of that information. Since\nptep_modify_prot_start() gets and clears atomically, the following is the\ncorrect pattern and prevents any possible race. Any access after the\nfirst call would see an invalid pte and cause a fault:\n\n pte = ptep_modify_prot_start(ptep);\n pte = pte_mkuffd_wp(pte);\n ptep_modify_prot_commit(ptep, pte);"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/proc/task_mmu: corrige la p\u00e9rdida de bits j\u00f3venes/sucios durante el escaneo del mapa de p\u00e1ginas que make_uffd_wp_pte() estaba haciendo anteriormente: pte = ptep_get(ptep); ptep_modify_prot_start(ptep); pte = pte_mkuffd_wp(pte); ptep_modify_prot_commit(ptep,pte); Pero si otro hilo accedi\u00f3 o ensuci\u00f3 el pte entre las 2 primeras llamadas, esto podr\u00eda provocar la p\u00e9rdida de esa informaci\u00f3n. Dado que ptep_modify_prot_start() obtiene y borra at\u00f3micamente, el siguiente es el patr\u00f3n correcto y evita cualquier posible ejecuci\u00f3n. Cualquier acceso despu\u00e9s de la primera llamada ver\u00eda un pte no v\u00e1lido y provocar\u00eda una falla: pte = ptep_modify_prot_start(ptep); pte = pte_mkuffd_wp(pte); ptep_modify_prot_commit(ptep,pte);"}], "id": "CVE-2024-36943", "lastModified": "2024-11-21T09:22:52.417", "metrics": {}, "published": "2024-05-30T16:15:17.307", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/74b3d66f91d9f539f99faad74d796fa9a389a015"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c70dce4982ce1718bf978a35f8e26160b82081f4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/74b3d66f91d9f539f99faad74d796fa9a389a015"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://git.kernel.org/stable/c/c70dce4982ce1718bf978a35f8e26160b82081f4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan", "id": "2284470", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2284470"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nfs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan\nmake_uffd_wp_pte() was previously doing:\npte = ptep_get(ptep);\nptep_modify_prot_start(ptep);\npte = pte_mkuffd_wp(pte);\nptep_modify_prot_commit(ptep, pte);\nBut if another thread accessed or dirtied the pte between the first 2\ncalls, this could lead to loss of that information. Since\nptep_modify_prot_start() gets and clears atomically, the following is the\ncorrect pattern and prevents any possible race. Any access after the\nfirst call would see an invalid pte and cause a fault:\npte = ptep_modify_prot_start(ptep);\npte = pte_mkuffd_wp(pte);\nptep_modify_prot_commit(ptep, pte);"], "name": "CVE-2024-36943", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-36943\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-36943\nhttps://lore.kernel.org/linux-cve-announce/2024053038-CVE-2024-36943-de68@gregkh/T"], "threat_severity": "Moderate", "upstream_fix": "kernel 6.8.10, kernel 6.9"}