CVE-2024-47676

Description

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb.c: fix UAF of vma in hugetlb fault pathway Syzbot reports a UAF in hugetlb_fault(). This happens because vmf_anon_prepare() could drop the per-VMA lock and allow the current VMA to be freed before hugetlb_vma_unlock_read() is called. We can fix this by using a modified version of vmf_anon_prepare() that doesn't release the VMA lock on failure, and then release it ourselves after hugetlb_vma_unlock_read().

CVSS Metrics

• v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.02%• Percentile: 6%

Techniques & Countermeasures

• CWE-416•Use After Free

  The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected Systems

• linux•linux

  ≥ 9acad7ba3e25d11f4c96df1b7312ae89e6faca5c, < e897d184a8dd4a4e1f39c8c495598e4d9472776c | ≥ 9acad7ba3e25d11f4c96df1b7312ae89e6faca5c, < d59ebc99dee0a2687a26df94b901eb8216dbf876 | ≥ 9acad7ba3e25d11f4c96df1b7312ae89e6faca5c, < 98b74bb4d7e96b4da5ef3126511febe55b76b807 | 6.9

• linux•linux_kernel

  ≥ 6.9, < 6.10.13 | ≥ 6.11, < 6.11.2

References (3)

• https://git.kernel.org/stable/c/e897d184a8dd4a4e1f39c8c495598e4d9472776c
• https://git.kernel.org/stable/c/d59ebc99dee0a2687a26df94b901eb8216dbf876
• https://git.kernel.org/stable/c/98b74bb4d7e96b4da5ef3126511febe55b76b807