CVE-2024-42233 filemap: replace pte_offset_map() with pte_offset_map_nolock()
A race condition in the Linux kernel filemap fault handler can lead to a use-after-free, potentially allowing local attackers to execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-42233?
CVE-2024-42233 is a high-severity use after free vulnerability in Linux kernel, published on 7 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
filemap: replace pte_offset_map() with pte_offset_map_nolock()
The vmf->ptl in filemap_fault_recheck_pte_none() is still set from handle_pte_fault(). But at the same time, we did a pte_unmap(vmf->pte). After a pte_unmap(vmf->pte) unmap and rcu_read_unlock(), the page table may be racily changed and vmf->ptl maybe fails to protect the actual page table. Fix this by replacing pte_offset_map() with pte_offset_map_nolock().
As David said, the PTL pointer might be stale so if we continue to use it infilemap_fault_recheck_pte_none(), it might trigger UAF. Also, if the PTL fails, the issue fixed by commit 58f327f2ce80 ("filemap: avoid unnecessary major faults in filemap_fault()") might reappear.
Which versions are affected by CVE-2024-42233?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-42233?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-42233 being exploited?
There is no known exploitation of CVE-2024-42233 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-42233, DEBIAN-CVE-2024-42233, GHSA-2rr5-68hg-rwmh, UBUNTU-CVE-2024-42233.