CVE-2023-52934

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups

In commit 34488399fa08 ("mm/madvise: add file and shmem support to

MADV_COLLAPSE") we make the following change to find_pmd_or_thp_or_none():

- if (!pmd_present(pmde))

- return SCAN_PMD_NULL;

+ if (pmd_none(pmde))

+ return SCAN_PMD_NONE;

This was for-use by MADV_COLLAPSE file/shmem codepaths, where

MADV_COLLAPSE might identify a pte-mapped hugepage, only to have

khugepaged race-in, free the pte table, and clear the pmd. Such codepaths

include:

A) If we find a suitably-aligned compound page of order HPAGE_PMD_ORDER

already in the pagecache.

B) In retract_page_tables(), if we fail to grab mmap_lock for the target

mm/address.

In these cases, collapse_pte_mapped_thp() really does expect a none (not

just !present) pmd, and we want to suitably identify that case separate

from the case where no pmd is found, or it's a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References