CVE-2024-56612 mm/gup: handle NULL pages in unpin_user_pages()

In the Linux kernel, the following vulnerability has been resolved: mm/gup: handle NULL pages in unpinuserpages The recent addition of "pofs" pages or folios handling to gup has a flaw: it assumes that unpinuserpages handles NULL pages in the pages array. That's not the case, as I discovered when...

CVE-2024-56612: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: mm/gup: handle NULL pages in unpinuserpages The recent addition of "pofs" pages or folios handling to gup has a flaw: it assumes that unpinuserpages handles NULL pages in the pages array. That's not the case, as I discovered when...

kernel: mm/secretmem: fix GUP-fast succeeding on secretmem folios

In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix GUP-fast succeeding on secretmem folios The Linux kernel CVE team has assigned CVE-2024-35872 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051941-CVE-2024-35872-4632@gregkh/T...

SUSE CVE-2022-48986

In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix guppudrange for dax For dax pud, pudhuge returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn't depend on hugetlb. Commit 414fd080d125 "mm/gup: fix guppmdrange for dax" fixed...

CVE-2022-48986

In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix guppudrange for dax For dax pud, pudhuge returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn't depend on hugetlb. Commit 414fd080d125 "mm/gup: fix guppmdrange for dax" fixed...

CVE-2024-49872

In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix memfdpinfolios alloc race panic If memfdpinfolios tries to create a hugetlb page, but someone else already did, then folio gets the value -EEXIST here: folio = memfdallocfoliomemfd, startidx; if ISERRfolio ret =...

DEBIAN-CVE-2022-48986

In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix guppudrange for dax For dax pud, pudhuge returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn't depend on hugetlb. Commit 414fd080d125 "mm/gup: fix guppmdrange for dax" fixed...

UBUNTU-CVE-2022-48986

In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix guppudrange for dax For dax pud, pudhuge returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn't depend on hugetlb. Commit 414fd080d125 "mm/gup: fix guppmdrange for dax" fixed...

CVE-2022-48986

CVE-2022-48986 is a Linux kernel issue in the memory management path (mm/gup) affecting devmap-backed dax mappings. The vulnerability arises from gup_pud_range() returning true for pud_huge() on x86 when hugetlb is configured, while dax does not depend on hugetlb. The fixes, including commits 414...

CVE-2022-48986 mm/gup: fix gup_pud_range() for dax

In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix guppudrange for dax For dax pud, pudhuge returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn't depend on hugetlb. Commit 414fd080d125 "mm/gup: fix guppmdrange for dax" fixed...

CVE-2024-49872

The CVE-2024-49872 issue affects the Linux kernel in mm/gup where memfd_pin_folios can race when creating a hugetlb folio and another actor has already done so, leading to a -EEXIST and a panicking folio_put call if the same folio is used in the next loop iteration. The patch fixes the race by cl...

CVE-2024-49872 mm/gup: fix memfd_pin_folios alloc race panic

In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix memfdpinfolios alloc race panic If memfdpinfolios tries to create a hugetlb page, but someone else already did, then folio gets the value -EEXIST here: folio = memfdallocfoliomemfd, startidx; if ISERRfolio ret =...

CVE-2024-49872 mm/gup: fix memfd_pin_folios alloc race panic

In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix memfdpinfolios alloc race panic If memfdpinfolios tries to create a hugetlb page, but someone else already did, then folio gets the value -EEXIST here: folio = memfdallocfoliomemfd, startidx; if ISERRfolio ret =...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that originates from the mm/gup module not properly handling the guppudrange function when processing dax pud...

CVE-2024-49872: Concurrent Execution using Shared Resource with Improper Synchronization

In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix memfdpinfolios alloc race panic If memfdpinfolios tries to create a hugetlb page, but someone else already did, then folio gets the value -EEXIST here: folio = memfdallocfoliomemfd, startidx; if ISERRfolio ret =...

CVE-2024-45024

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb vs. core-mm PT locking We recently made GUP's common page table walking code to also walk hugetlb VMAs without most hugetlb special-casing, preparing for the future of having less hugetlb-specific page tab...

CVE-2024-45024

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb vs. core-mm PT locking We recently made GUP's common page table walking code to also walk hugetlb VMAs without most hugetlb special-casing, preparing for the future of having less hugetlb-specific page tab...

CVE-2024-45024 mm/hugetlb: fix hugetlb vs. core-mm PT locking

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb vs. core-mm PT locking We recently made GUP's common page table walking code to also walk hugetlb VMAs without most hugetlb special-casing, preparing for the future of having less hugetlb-specific page tab...

CVE-2024-45024 mm/hugetlb: fix hugetlb vs. core-mm PT locking

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix hugetlb vs. core-mm PT locking We recently made GUP's common page table walking code to also walk hugetlb VMAs without most hugetlb special-casing, preparing for the future of having less hugetlb-specific page tab...

CVE-2024-45024

CVE-2024-45024 relates to a Linux kernel Hugetlb PT locking issue fixed by aligning huge page table locking with core-mm PT walkers. The root cause: during GUP’s shared page-table walking, hugetlb folios spanning multiple PTEs could be locked using PTE table locks (pte_offset_map_lock) while core...