CVE-2024-45024

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix hugetlb vs. core-mm PT locking

We recently made GUP's common page table walking code to also walk hugetlb

VMAs without most hugetlb special-casing, preparing for the future of

having less hugetlb-specific page table walking code in the codebase.

Turns out that we missed one page table locking detail: page table locking

for hugetlb folios that are not mapped using a single PMD/PUD.

Assume we have hugetlb folio that spans multiple PTEs (e.g., 64 KiB

hugetlb folios on arm64 with 4 KiB base page size). GUP, as it walks the

page tables, will perform a pte_offset_map_lock() to grab the PTE table

lock.

However, hugetlb that concurrently modifies these page tables would

actually grab the mm->page_table_lock: with USE_SPLIT_PTE_PTLOCKS, the

locks would differ. Something similar can happen right now with hugetlb

folios that span multiple PMDs when USE_SPLIT_PMD_PTLOCKS.

This issue can be reproduced [1], f

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References