CVE-2024-46787

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

userfaultfd: fix checks for huge PMDs

Patch series "userfaultfd: fix races around pmd_trans_huge() check", v2.

The pmd_trans_huge() code in mfill_atomic() is wrong in three different

ways depending on kernel version:

1. The pmd_trans_huge() check is racy and can lead to a BUG_ON() (if you hit

the right two race windows) - I've tested this in a kernel build with

some extra mdelay() calls. See the commit message for a description

of the race scenario.

On older kernels (before 6.5), I think the same bug can even

theoretically lead to accessing transhuge page contents as a page table

if you hit the right 5 narrow race windows (I haven't tested this case).

2. As pointed out by Qi Zheng, pmd_trans_huge() is not sufficient for

detecting PMDs that don't point to page tables.

On older kernels (before 6.5), you'd just have to win a single fairly

wide race to hit this.

I've tested this on 6.1 sta

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References