CVE-2024-35872 mm/secretmem: fix GUP-fast succeeding on secretmem folios
A flaw in the Linux kernel allows GUP-fast to access secretmem folios, causing a kernel crash and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-35872?
CVE-2024-35872 is a high-severity denial of service vulnerability in Linux kernel, published on 19 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm/secretmem: fix GUP-fast succeeding on secretmem folios
folio_is_secretmem() currently relies on secretmem folios being LRU folios, to save some cycles.
However, folios might reside in a folio batch without the LRU flag set, or temporarily have their LRU flag cleared. Consequently, the LRU flag is unreliable for this purpose.
In particular, this is the case when secretmem_fault() allocates a fresh page and calls filemap_add_folio()->folio_add_lru(). The folio might be added to the per-cpu folio batch and won't get the LRU flag set until the batch was drained using e.g., lru_add_drain().
Consequently, folio_is_secretmem() might not detect secretmem folios and GUP-fast can succeed in grabbing a secretmem folio, crashing the kernel when we would later try reading/writing to the folio, because the folio has been unmapped from the directmap.
Fix it by removing that unreliable check.
Which versions are affected by CVE-2024-35872?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-35872?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-35872 being exploited?
There is no known exploitation of CVE-2024-35872 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-35872, DEBIAN-CVE-2024-35872, GHSA-m7cw-h386-9wgp, UBUNTU-CVE-2024-35872.