CVE-2022-50014

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW

Ever since the Dirty COW (CVE-2016-5195) security issue happened, we know

that FOLL_FORCE can be possibly dangerous, especially if there are races

that can be exploited by user space.

Right now, it would be sufficient to have some code that sets a PTE of a

R/O-mapped shared page dirty, in order for it to erroneously become

writable by FOLL_FORCE. The implications of setting a write-protected PTE

dirty might not be immediately obvious to everyone.

And in fact ever since commit 9ae0f87d009c ("mm/shmem: unconditionally set

pte dirty in mfill_atomic_install_pte"), we can use UFFDIO_CONTINUE to map

a shmem page R/O while marking the pte dirty. This can be used by

unprivileged user space to modify tmpfs/shmem file content even if the

user does not have write permissions to the file, and to bypass memfd

write sealing -- Dirty COW restricted to tmpfs/shmem (CV

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References