CVE-2024-49873

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/filemap: fix filemap_get_folios_contig THP panic

Patch series "memfd-pin huge page fixes".

Fix multiple bugs that occur when using memfd_pin_folios with hugetlb

pages and THP. The hugetlb bugs only bite when the page is not yet

faulted in when memfd_pin_folios is called. The THP bug bites when the

starting offset passed to memfd_pin_folios is not huge page aligned. See

the commit messages for details.

This patch (of 5):

memfd_pin_folios on memory backed by THP panics if the requested start

offset is not huge page aligned:

BUG: kernel NULL pointer dereference, address: 0000000000000036

RIP: 0010:filemap_get_folios_contig+0xdf/0x290

RSP: 0018:ffffc9002092fbe8 EFLAGS: 00010202

RAX: 0000000000000002 RBX: 0000000000000002 RCX: 0000000000000002

The fault occurs here, because xas_load returns a folio with value 2:

filemap_get_folios_contig()

for (folio = xas_load(&xas); folio && xas.xa_index <= end;

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References