CVE-2024-35877

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

x86/mm/pat: fix VM_PAT handling in COW mappings

PAT handling won't do the right thing in COW mappings: the first PTE (or,

in fact, all PTEs) can be replaced during write faults to point at anon

folios. Reliably recovering the correct PFN and cachemode using

follow_phys() from PTEs will not work in COW mappings.

Using follow_phys(), we might just get the address+protection of the anon

folio (which is very wrong), or fail on swap/nonswap entries, failing

follow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and

track_pfn_copy(), not properly calling free_pfn_range().

In free_pfn_range(), we either wouldn't call memtype_free() or would call

it with the wrong range, possibly leaking memory.

To fix that, let's update follow_phys() to refuse returning anon folios,

and fallback to using the stored PFN inside vma->vm_pgoff for COW mappings

if we run into that.

We will now properly handle untrack_pfn() with COW

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References