CVE-2024-47745

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: call the security_mmap_file() LSM hook in remap_file_pages()

The remap_file_pages syscall handler calls do_mmap() directly, which

doesn't contain the LSM security check. And if the process has called

personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for

RW pages, this will actually result in remapping the pages to RWX,

bypassing a W^X policy enforced by SELinux.

So we should check prot by security_mmap_file LSM hook in the

remap_file_pages syscall handler before do_mmap() is called. Otherwise, it

potentially permits an attacker to bypass a W^X policy enforced by

SELinux.

The bypass is similar to CVE-2016-10044, which bypass the same thing via

AIO and can be found in [1].

The PoC:

$ cat > test.c

int main(void) {

size_t pagesz = sysconf(_SC_PAGE_SIZE);

int mfd = syscall(SYS_memfd_create, "test", 0);

const char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,

MAP_SHARED, mfd, 0);

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References