CVE-2017-1000405 Race condition in n/a

High 7.0 Published 30 Nov 2017 Updated 5 Aug 2024

A race condition in the Linux Kernel Transparent Huge Pages implementation allows attackers to overwrite read-only huge pages, potentially leading to privilege escalation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2017-1000405?

CVE-2017-1000405 is a high-severity vulnerability in Linux kernel, published on 30 Nov 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd() function inside the THP implementation. touch_pmd() can be reached by get_user_pages(). In such case, the pmd will become dirty. This scenario breaks the new can_follow_write_pmd()'s logic - pmd can become dirty without going through a COW cycle. This bug is not as severe as the original "Dirty cow" because an ext4 file (or any other regular file) cannot be mapped using THP. Nevertheless, it does allow us to overwrite read-only huge pages. For example, the zero huge page and sealed shmem files can be overwritten (since their mapping can be populated using THP). Note that after the first write page-fault to the zero page, it will be replaced with a new fresh (and zeroed) thp.

Weakness: CWE-362

Which versions are affected by CVE-2017-1000405?

It affects 1 product.

Linux distribution packages (21)

`kernel` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`kernel-abi-whitelists` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`kernel-alt` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`kernel-bootwrapper` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`kernel-debug` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`kernel-debug-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`kernel-debug-devel` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`kernel-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`kernel-debuginfo-common-aarch64` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`kernel-debuginfo-common-ppc64le` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`kernel-devel` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`kernel-doc` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`kernel-headers` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`kernel-tools` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`kernel-tools-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`kernel-tools-libs` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`kernel-tools-libs-devel` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`perf` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`perf-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`python-perf` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`
`python-perf-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:4.11.0-44.4.1.el7a`

Products include Linux kernel.

How do I fix CVE-2017-1000405?

Apply the vendor's patch.

Is CVE-2017-1000405 being exploited?

There is no known exploitation of CVE-2017-1000405 in the wild and no public exploit code.

Public exploit code: 2 Exploit-DB entries and 1 proofs of concept on GitHub.

All Linux kernel vulnerabilities

Sources

Also known as DEBIAN-CVE-2017-1000405, GHSA-c6vh-7mwq-c4gc, RHSA-2018:0180, UBUNTU-CVE-2017-1000405.