CVE-2024-49964

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix memfd_pin_folios free_huge_pages leak

memfd_pin_folios followed by unpin_folios fails to restore free_huge_pages

if the pages were not already faulted in, because the folio refcount for

pages created by memfd_alloc_folio never goes to 0. memfd_pin_folios

needs another folio_put to undo the folio_try_get below:

memfd_alloc_folio()

alloc_hugetlb_folio_nodemask()

dequeue_hugetlb_folio_nodemask()

dequeue_hugetlb_folio_node_exact()

folio_ref_unfreeze(folio, 1); ; adds 1 refcount

folio_try_get() ; adds 1 refcount

hugetlb_add_to_page_cache() ; adds 512 refcount (on x86)

With the fix, after memfd_pin_folios + unpin_folios, the refcount for the

(unfaulted) page is 512, which is correct, as the refcount for a faulted

unpinned page is 513.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References