CVE-2022-49049

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/secretmem: fix panic when growing a memfd_secret

When one tries to grow an existing memfd_secret with ftruncate, one gets

a panic [1]. For example, doing the following reliably induces the

panic:

fd = memfd_secret();

ftruncate(fd, 10);

ptr = mmap(NULL, 10, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);

strcpy(ptr, "123456789");

munmap(ptr, 10);

ftruncate(fd, 20);

The basic reason for this is, when we grow with ftruncate, we call down

into simple_setattr, and then truncate_inode_pages_range, and eventually

we try to zero part of the memory. The normal truncation code does this

via the direct map (i.e., it calls page_address() and hands that to

memset()).

For memfd_secret though, we specifically don't map our pages via the

direct map (i.e. we call set_direct_map_invalid_noflush() on every

fault). So the address returned by page_address() isn't useful, and

when we try to memset() with it

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References