CVE-2024-36000 mm/hugetlb: fix missing hugetlb_lock for resv uncharge
A race condition in the Linux kernel hugetlb subsystem can cause a kernel assertion failure, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-36000?
CVE-2024-36000 is a medium-severity vulnerability in Linux kernel, published on 20 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: fix missing hugetlb_lock for resv uncharge
There is a recent report on UFFDIO_COPY over hugetlb:
https://lore.kernel.org/all/[email protected]/
350: lockdep_assert_held(&hugetlb_lock);
Should be an issue in hugetlb but triggered in an userfault context, where it goes into the unlikely path where two threads modifying the resv map together. Mike has a fix in that path for resv uncharge but it looks like the locking criteria was overlooked: hugetlb_cgroup_uncharge_folio_rsvd() will update the cgroup pointer, so it requires to be called with the lock held.
Weakness: CWE-617
Which versions are affected by CVE-2024-36000?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-36000?
Apply the vendor's patch.
Is CVE-2024-36000 being exploited?
There is no known exploitation of CVE-2024-36000 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-67703, BELL-CVE-2024-36000, DEBIAN-CVE-2024-36000, GHSA-j4cv-xr5r-hq23, ROOT-OS-DEBIAN-11-CVE-2024-36000, ROOT-OS-UBUNTU-2204-CVE-2024-36000 and 1 more.